CORAA
AI Lab · Prompt Library

Prompts for audit, not for marketing.

29 vetted prompts you can copy and adapt to your engagement. Categorised by audit phase. Each one keeps client data off the prompt — methodology, anonymised inputs, no identifiers.

Read the Practical Guide first if you haven’t — it covers what to keep off the prompt, how to document AI use under SA 230, and which audit phases AI helps with most.

Planning

Industry risk briefing for engagement planning

When to use: Before the planning meeting — get a quick brief on the typical audit risks for the client's industry, no client data needed.

I'm planning the statutory audit of an Indian [SECTOR — e.g. wholesale auto-parts distribution] company under the Companies Act 2013. Turnover bracket is roughly [SIZE BAND — e.g. ₹100-300 cr]. Without referring to any specific entity, give me:

1. The 6-8 typical audit risks for this industry, ranked by significance
2. The accounting policies that tend to be judgement-heavy in this sector
3. The CARO 2020 clauses most likely to have observations in this industry
4. Any sector-specific SAs or Ind AS standards I should pay attention to
5. Common fraud schemes in this sector (for SA 240 consideration)

Cite the relevant SA / Ind AS / Companies Act provisions where applicable. Keep it Indian-context.
What not to paste with this prompt
  • Do not name the client
  • Use a size band, not specific figures
  • Use industry, not specific business model
SA 315 (Revised)SA 240CARO 2020
Planning

Audit strategy memorandum outline

When to use: Build the skeleton of an SA 300 audit strategy memo. You fill in the engagement-specific facts.

Draft the outline of an audit strategy memorandum under SA 300 for an Indian statutory audit. Include sections for:

- Scope of the engagement (Companies Act 2013, applicable Ind AS / AS)
- Reporting objectives, timing, and required communications
- Significant factors directing the engagement effort
- Preliminary engagement activities and prior-period results
- Nature, timing and extent of resources
- Materiality benchmarks under consideration
- Risk areas requiring special audit consideration

Keep each section as headings and one-line prompts for the engagement team to fill in. No content for the entity itself.
SA 300
Planning

Materiality benchmark rationale, generically

When to use: Talk through which benchmark fits — turnover, PBT, asset base — without revealing the client's numbers.

For an Indian statutory audit, walk me through the considerations for choosing a materiality benchmark under SA 320. Cover:

1. When PBT / continuing-operations PBT is the right benchmark
2. When total revenue / turnover is preferable
3. When gross profit, equity, or total assets become the relevant base
4. Typical percentage ranges applied to each benchmark
5. The link between overall materiality and performance materiality
6. The link to clearly trivial threshold
7. Documentation expectations under SA 230

Cite SA 320 paragraphs where relevant. Indian context — no IFRS-only references.
SA 320SA 230
Planning

Going concern indicators — early-stage scan

When to use: Get a structured list of indicators to look for in the planning data review (without uploading the data).

Give me a structured list of the financial, operating and other indicators of going-concern uncertainty under SA 570 (Revised) that I should look for during the planning-stage analytical review of an Indian SME. Organise as:

- Financial indicators (8-12, including India-specific items like statutory dues backlogs and overdrawn working-capital limits)
- Operating indicators
- Other indicators (legal, regulatory, sectoral)
- For each, what kind of evidence at planning stage would warrant further investigation

Keep it practical — the kind of things a manager would scan a TB or aged-payables report for, without telling me anything specific.
SA 570 (Revised)
Risk assessment

Risks of material misstatement — brainstorm list

When to use: Generate a comprehensive ROMM long-list for a sector. You then assess likelihood and magnitude for the actual engagement.

Brainstorm a long-list of risks of material misstatement at the assertion level for an Indian [SECTOR] company. Cover both:

- Financial statement level risks (fraud risk, complex transactions, judgement-heavy estimates)
- Account-level risks for each major balance sheet line item (PPE, inventory, trade receivables, trade payables, borrowings, share capital, revenue, employee costs)

For each risk, name the relevant assertion (existence / completeness / accuracy / valuation / cut-off / classification / presentation). Map to the responding SA.

Stay generic — no client data.
SA 315 (Revised)SA 330
Risk assessment

Sector-specific fraud schemes (SA 240)

When to use: Required brainstorming under SA 240 — generate the list you discuss in the engagement team meeting.

For an Indian [SECTOR] company, list the typical fraud schemes I should brainstorm with my engagement team for SA 240 purposes. Organise by:

1. Fraudulent financial reporting schemes (revenue recognition manipulation, expense deferral, related-party misuse, journal-entry abuse)
2. Misappropriation of assets (cash, inventory, fixed assets, payroll ghost employees)
3. Schemes that have come up in recent NFRA orders or ICAI disciplinary actions in this sector — describe the pattern, no names
4. Red flags that would indicate each scheme

End with the specific audit responses SA 240 requires for each significant risk.
SA 240
Risk assessment

IFC / ICFR process-level risk and control matrix

When to use: Generate the RCM skeleton for a process (P2P, O2C, R2R, Payroll, FA). You fill in the control activities for the entity.

Generate a risk and control matrix skeleton for the [PROCESS — e.g. Procure-to-Pay] process in an Indian manufacturing company, for ICFR audit under Section 143(3)(i) of the Companies Act 2013. Include columns for:

- Process sub-step
- Risk / "what could go wrong"
- Assertion impacted
- Key control objective
- Control activity (placeholder, to be filled by engagement team)
- Control type (preventive / detective)
- Frequency (transactional / periodic)
- Automated / manual / IT-dependent

Cover the 10-15 most common control points for this process. Don't invent controls the entity has — leave control activity blank.
Section 143(3)(i) — Companies Act 2013ICAI Guidance Note on IFC
Sampling

Monetary unit sampling — sample size rationale

When to use: Build the rationale paragraph for an MUS sample. You input the parameters; AI helps you write a defensible memo.

Help me write a sampling memorandum under SA 530 for a monetary unit sample for substantive testing of [POPULATION — e.g. trade payables]. The parameters to discuss:

- Tolerable misstatement at [X% of overall materiality]
- Expected misstatement at [Y% of tolerable]
- Confidence level [95% / 90%]
- Stratification considerations
- Treatment of items above tolerable misstatement (100% testing)
- Projection of misstatements found
- Evaluation against tolerable misstatement

Write it as the memorandum a senior would put into the file. Cite the relevant SA 530 paragraphs. Use placeholders for percentages — don't pick them.
SA 530
Sampling

Attribute sampling for control testing

When to use: Defend a sample size for testing operating effectiveness of a control under SA 330 / SA 530.

Draft the sample size rationale for attribute sampling on a control under SA 330. The control operates [FREQUENCY — daily / weekly / monthly]. We're testing for operating effectiveness in support of an ICFR conclusion. Cover:

- Expected deviation rate at [X%]
- Tolerable deviation rate at [Y%]
- Risk of overreliance (typically 5-10%)
- Resulting sample size from the AICPA / ICAI sampling tables (give the range)
- Documentation requirements
- What constitutes a deviation
- Treatment of any deviations found — escalation, follow-up, conclusion

Methodology only. No client-specific control description.
SA 330SA 530
Sampling

AI-flagged item evaluation memo

When to use: When a tool like MindBridge flags transactions — how to triage and document.

I have a list of journal-entry anomalies flagged by an audit-grade pattern detection tool. The flag categories include: weekend / holiday postings, manual JVs by unusual users, round-number entries above ₹X, debits to revenue accounts, entries reversed within N days. Without seeing the data:

1. For each flag category, what's the typical underlying explanation (often legitimate) vs the fraud risk pattern
2. What follow-up procedures would be appropriate for each
3. The conclusion structure for each — what makes a flag "resolved"
4. The aggregate conclusion the auditor draws from the full review

I'll evaluate each item myself; give me the structured approach.
SA 240SA 330SA 530
Vouching & substantive

Revenue cut-off testing programme

When to use: Build a cut-off testing programme for revenue around year-end.

Generate a revenue cut-off testing programme for an Indian [SECTOR] company under Ind AS 115 / AS 9. Cover:

- The pre-year-end window to test (typically 5-10 working days before)
- The post-year-end window to test (typically 5-10 working days after)
- Documents to vouch to (delivery challan, e-way bill, sales invoice, buyer acknowledgement, contractual terms on transfer of control)
- The audit assertion at issue (cut-off, completeness, occurrence)
- Working paper conclusion format
- Treatment of bill-and-hold or principal-vs-agent edge cases

Don't ask me for the entity's data. Generate the programme template.
Ind AS 115 / AS 9SA 500SA 330
Vouching & substantive

Procurement three-way match testing

When to use: Procure-to-Pay substantive testing — purchase order vs goods receipt vs invoice.

Draft a substantive testing programme for procurement three-way match (PO ↔ GRN ↔ Vendor Invoice) for an Indian manufacturing company. Cover:

- Selection criteria for the sample
- For each selected item, the matching attributes to verify
- Tolerance thresholds for differences
- Procedure when items don't match
- Audit assertions covered (occurrence, accuracy, classification, cut-off)
- Working paper documentation format
- Implications for control testing if mismatches indicate control weakness

Methodology only. No client-specific values.
SA 500SA 330
Vouching & substantive

Bank reconciliation review procedure

When to use: How to substantively review a client's bank reconciliation at year-end.

Walk me through the review procedure for a year-end bank reconciliation prepared by the client, for an Indian statutory audit. Cover:

- Verification against the bank statement (direct confirmation under SA 505 vs reliance on bank statement)
- Outstanding cheque review — staleness, bouncing risk, fictitious cheques pattern
- Outstanding deposit review — clearing timing, possible kiting
- Stale balances (cheques older than 3 months)
- Reconciliation as at the audit date (post-period activity)
- Common manipulation schemes (lapping, kiting) and the procedures that detect them
- Working paper conclusion

No client data — methodology only.
SA 505SA 500SA 240
CARO 2020

CARO clause (iii) — loans, investments, guarantees

When to use: Draft the clause (iii) observation once the underlying work is done.

Draft the CARO 2020 clause (iii) reporting in the audit report annexure for an Indian company. The underlying audit conclusion is: [fill in — e.g. "the Company has granted unsecured loans of ₹X cr to one body corporate during the year, terms repayable on demand with interest at Y%"].

Use the standard ICAI illustrative format. Include the table format prescribed under sub-clauses (a) through (f). Maintain consistent voice with the rest of the annexure. Don't invent any facts — only restate what I've told you, in the prescribed structure.
CARO 2020 clause (iii)Companies Act 2013 — Section 143(11)
CARO 2020

CARO clause (vii) — statutory dues

When to use: Draft the clause (vii) text for both regularity of payment and pending disputed dues.

Draft CARO 2020 clause (vii) reporting for an Indian company. The underlying audit conclusion is: [fill in — e.g. "statutory dues have generally been deposited regularly with appropriate authorities, except for X. No disputed dues are pending."].

Use the ICAI illustrative format for both sub-clauses:
- (a) Regularity in depositing undisputed statutory dues
- (b) Particulars of statutory dues disputed and not deposited

For (b), include the prescribed columns (Name of statute / Nature of dues / Amount / Period / Forum where dispute is pending). Leave the amounts as placeholders for me to fill from the working papers.
CARO 2020 clause (vii)
CARO 2020

CARO not-applicable clauses — language template

When to use: Draft consistent not-applicable language across multiple CARO clauses.

For CARO 2020 reporting, draft the standard not-applicable language for the following clauses (assuming the underlying facts support not-applicable):

- (iv) Loans to directors and connected persons — Company has not granted any loans / advances / made investments in directors or related persons
- (v) Public deposits — Company has not accepted any deposits
- (viii) Undisclosed income surrender — No income surrender / disclosure relevant under Income Tax Act search proceedings
- (xii) Nidhi Company — not applicable as Company is not a Nidhi Company
- (xiv) Internal audit system — give framing for "yes, system commensurate with size and operations"
- (xv) Non-cash transactions with directors — no such transactions

Keep voice and formatting consistent with the ICAI illustrative format. Don't editorialise — just the prescribed language.
CARO 2020
CARO 2020

CARO 2020 completeness self-check

When to use: Before signing, run through whether all 21 clauses are addressed.

Give me the completeness checklist for the CARO 2020 audit report annexure, with each of the 21 clauses (and sub-clauses where they exist) listed in order. For each:

- Clause number and one-line description
- The sub-clauses where applicable (e.g. (iii)(a) through (iii)(f))
- A yes/no flag for "addressed in our annexure"
- A column for the working-paper reference

Lay it out as a table I can copy into Excel. No conclusions about any entity — just the structure to self-check our draft.
CARO 2020
Drafting

Engagement letter draft starter

When to use: Generate the SA 210 engagement letter starter. (Or use the generator at /tools/templates/engagement-letter.)

Draft the body of an audit engagement letter under SA 210 for an Indian statutory audit under the Companies Act 2013. Include sections for:

- Objective and scope (under Section 143 of the Companies Act, SAs issued by ICAI)
- Auditor's responsibilities (independence, professional skepticism, materiality, communication of significant deficiencies)
- Management's responsibilities under Section 134(5) (FS preparation, internal controls, access to records, written representations)
- Form of report (SA 700/701/705/706, CARO 2020 annexure under 143(11))
- Fees and billing terms (leave placeholder)
- Working paper ownership and confidentiality
- Acknowledgement and acceptance by client

Use the SA 210 Appendix illustrative letter as the structural reference. Leave entity-specific placeholders blank — I'll fill them in.
SA 210Section 143 Companies Act 2013
Drafting

Management representation letter — body

When to use: Draft the MRL body under SA 580 once you've done the underlying work. Pair with /tools/templates/management-representation-letter.

Draft the body of a Management Representation Letter under SA 580 for an Indian statutory audit. The letter is on the entity's letterhead, addressed to the auditor, dated as of the audit report date. Cover the required representations:

1. Financial statements responsibility (Section 134(5))
2. Completeness of information (records, board minutes, contracts)
3. Going concern assessment
4. Subsequent events
5. Related-party transactions and Section 188 / Ind AS 24 disclosures
6. Litigation, claims, contingencies
7. Compliance with laws and regulations
8. Uncorrected misstatements (with the schedule attached)
9. Fraud risk awareness and any known/suspected fraud
10. Specific representations relevant to areas of significant judgement

Use the SA 580 illustrative format. Don't include entity-specific facts — leave placeholders.
SA 580SA 560SA 570
Drafting

Communication with TCWG (SA 260)

When to use: Draft the year-end SA 260 communication — significant findings, internal control deficiencies, audit scope.

Draft a Communication with Those Charged with Governance under SA 260 (Revised) for an Indian audit committee / board. Cover:

- Auditor's responsibilities in relation to the audit
- Planned scope and timing (high-level)
- Significant findings from the audit
- Significant deficiencies in internal control identified (SA 265 — if any to communicate)
- Auditor's views on significant qualitative aspects of the entity's accounting practices
- Difficulties encountered during the audit
- Significant matters discussed with management
- Material written communications between the auditor and management
- Confirmation of independence

Tone: formal, addressed to the Audit Committee Chair. Indian context — reference SA 260 and the Companies Act sections where they apply.
SA 260 (Revised)SA 265
Drafting

Going concern — material uncertainty paragraph

When to use: Draft the audit-report paragraph when there's a material uncertainty under SA 570.

Draft the "Material Uncertainty Related to Going Concern" paragraph for an Indian auditor's report under SA 570 (Revised). The underlying conclusion is: [fill in — e.g. "the company has incurred losses for three consecutive years and current liabilities exceed current assets, but management has obtained committed lender support letters of ₹X cr"].

Use the SA 700/705/706 illustrative format. Include:
- The factual basis for the material uncertainty
- A reference to the note in the financial statements where management has disclosed it
- The standard SA 570.22 wording that this does not modify our opinion

Don't add conclusions I haven't given you. Don't pad the language.
SA 570 (Revised)SA 700SA 706
Drafting

Key Audit Matter — KAM paragraph

When to use: Draft a KAM under SA 701. You input the matter; AI helps structure.

Draft a Key Audit Matter paragraph under SA 701 for the audit report of a listed Indian company. The matter is: [fill in — e.g. "valuation of trade receivables given concentration with a single customer accounting for X% of total receivables"].

Use the SA 701 prescribed structure:
1. The matter (one-paragraph factual statement, with reference to the relevant note in the FS)
2. Why the matter was a KAM (audit judgement involved, significance to FS)
3. How the matter was addressed in the audit (the procedures, not the conclusion — SA 701.A46)

Don't state the conclusion. Don't editorialise. Tight, two-three paragraphs total.
SA 701
Review

Engagement Quality Review (EQR) — focus areas

When to use: Generate the EQR partner's focus-list for a complex engagement.

Generate the focus-area checklist for an Engagement Quality Review under SA 220 (Revised) / SQM 2 for a complex Indian audit engagement. Organise by:

- Engagement acceptance and continuation decisions (judgement, independence)
- Significant judgements made by the engagement team
- Significant matters identified during the audit
- Evaluation of audit evidence sufficiency for high-risk areas
- Conclusions reached on going concern, KAMs, and modifications
- Independence of the engagement team
- Compliance with SQM 1
- Auditor's report (form, content, dating, modifications)

For each, the questions the EQR partner asks and the documentation they expect to see.
SA 220 (Revised)SQM 1SQM 2
Review

Working-paper file completeness review

When to use: Before sign-off — a structured review of the WP file against SA 230.

Generate a structured working-paper file completeness review checklist for an Indian statutory audit, mapped to SA 230 requirements. Cover:

- Engagement-level documents (engagement letter, independence confirmations, EQR sign-off)
- Planning documents (strategy, plan, risk register, materiality memo)
- Risk-response and substantive testing working papers
- Significant judgement papers (going concern, estimates, related parties)
- Communication-related papers (MRL, SA 260 communication, management letter)
- CARO annexure work papers
- Final review notes and clearance memos
- Auditor's report and FS comparison files

For each, what's expected, how to spot incompleteness. Methodology only.
SA 230SA 220 (Revised)
Review

Stress-test a going-concern conclusion

When to use: When the engagement team says "no material uncertainty" — interrogate the conclusion.

My engagement team has concluded that going concern is appropriate without a material uncertainty disclosure under SA 570 (Revised). The supporting evidence is [DESCRIBE GENERICALLY — e.g. "management's 12-month cash flow forecast with sensitivity to key revenue assumption, backed by committed working capital lines"].

Argue the opposite case — what counter-considerations under SA 570.16-18 would suggest a material uncertainty does exist. What additional evidence would the EQR partner reasonably ask for? What disclosure would be appropriate if the counter-case prevailed?

This is a stress-test exercise, not a conclusion. Make the case the team might have missed.
SA 570 (Revised)
Documentation

SA 230 working-paper entry — AI use disclosed

When to use: The canonical working-paper template when AI was used in any audit procedure.

Help me populate the SA 230 working-paper entry for an audit procedure where AI was used. Use this template:

Audit Procedure: [PROCEDURE]
Date Performed: [DD-MMM-YYYY]
Performed By: [INITIALS], [ROLE]
Reviewed By: [INITIALS], [ROLE]

AI Tool Used: [TOOL NAME, VERSION]
Purpose: [WHAT WE ASKED THE TOOL TO DO]
Inputs: [DESCRIBE CATEGORICALLY — what kind of information went in]
Outputs: [WHAT WE GOT BACK]
Auditor's Evaluation: [WHAT WE DID WITH THE OUTPUT]
Conclusion: [THE AUDITOR'S JUDGEMENT — NOT THE AI'S]

I'll give you the engagement-specific facts as placeholders; you write the auditor's-evaluation paragraph and the conclusion in the right voice (third person, past tense, file-grade). Don't invent facts I haven't given you.
SA 230SA 220 (Revised)
Documentation

Hallucination log — engagement-level

When to use: Track AI errors caught during the engagement. Builds firm-level intelligence over time.

Generate the structure for a hallucination log to maintain at engagement level. The log captures every time an AI tool returned a verifiable error during the audit. Columns:

- Date
- Procedure / work area
- Tool used
- The prompt or query
- What the AI claimed
- What was actually true
- How the error was caught
- Junior / senior / partner who caught it
- Whether the error would have made it to the file if uncaught
- Severity (informational / would have caused rework / could have caused misstatement)

Lay it out as a table I can copy into Excel. Add 3 example rows in the right tone — generic, illustrative, no real engagement data.
SA 230SA 220 (Revised)
Documentation

Firm-level AI use policy — outline

When to use: For SQM 1 compliance — a firm-level policy on how the firm uses AI in audit engagements.

Outline a firm-level policy document for how an Indian CA firm uses AI in audit engagements, for SQM 1 documentation. Cover:

1. Permitted use cases (categorised — drafting, methodology research, pattern detection, document extraction)
2. Prohibited uses (anything involving client data on consumer LLMs, conclusion-grade decisions)
3. Approved tools list (categorised — internal LLMs, audit-grade tools, public LLM enterprise tiers)
4. Mandatory disclosure when AI is used (SA 230 working-paper requirement)
5. Hallucination logging requirement
6. Confidentiality and client-data handling (with explicit guidance against pasting identifiable client data into consumer tools)
7. Engagement partner responsibility (cannot delegate the responsibility, can delegate execution)
8. Training and competence requirements for staff using AI
9. Periodic review of policy (annual)

Use headings and short policy statements — not a full document. I'll adapt for the firm.
SQM 1SA 220 (Revised)SA 230
Note on scope
CORAA AI Lab is a free practice environment built by CORAA. It is not a certification, not a substitute for any qualification issued by the Institute of Chartered Accountants of India (ICAI), and does not award structured CPE hours. ICAI’s official AI programmes — including AICA Level 1 and AURA — remain the authoritative credentials for AI competency in audit. We recommend using the Lab alongside or in preparation for ICAI’s programmes.