CORAA
Tool guide · OpenAI ChatGPT

ChatGPT for audit.

The most-used LLM in Indian CA firms today. What it’s genuinely useful for in audit work, where it falls short, and the features (GPTs, Code Interpreter, Custom Instructions, Memory) that matter specifically for CA practice.

Updated 28 May 2026 · ~10 min read

1 · What ChatGPT is, for an auditor

ChatGPT is OpenAI’s consumer-facing AI assistant. It’s the most widely adopted LLM in Indian CA firms — partly because of brand familiarity, partly because of the GPTs ecosystem, and partly because the free tier is genuinely useful for methodology and drafting work.

The single most relevant fact for Indian CAs: ICAI’s CA-GPT is built on the GPTs framework (i.e. you can access it from inside ChatGPT). It comes with 15+ specialised CA-domain GPTs covering auditing standards, internal audit, GST, direct tax, ethics, and sustainability reporting. Members get 20 free prompts per day; INR 499 / month gets unlimited. If you have an ICAI membership, you should be using CA-GPT before any other paid tier.

2 · What ChatGPT is good at, in audit work

2.1 · Fast first drafts

Engagement letters, MRLs, queries to management, audit observations, CARO clauses — ChatGPT produces a workable first draft in seconds. The voice is competent without being formal-stiff. Edit time is usually shorter than start-from-blank-page time.

2.2 · Prompt engineering and methodology Qs

Asking ChatGPT to brainstorm risks under SA 315, generate fraud schemes under SA 240, or walk through the considerations for SA 320 materiality benchmarks — it does this well. Treat it as a sparring partner for the methodology you already know.

2.3 · GPTs ecosystem (including CA-GPT)

GPTs are pre-configured assistants for specific tasks. ICAI’s CA-GPT is the canonical example for Indian audit work — separate sub-GPTs for Auditing and Assurance Standards, Internal Audit, GST and Indirect Taxes, Direct Taxes, Ethical Standards, Financial Reporting Review, Peer Review, Sustainability Reporting. Each one is grounded in ICAI’s curated knowledge base for that domain. Use it for standards-grounded questions where you’d otherwise have to read the bare standard.

2.4 · Code Interpreter (Advanced Data Analysis)

On Plus and above, the Code Interpreter writes and runs Python on data you upload. For an auditor: upload an anonymised CSV of journal entries, ask for entries that meet a specific pattern (weekend postings, round-number entries, debits to revenue, manual JVs above a threshold), get the filtered list back. Sample-size calculations, ratio analysis, ageing-bucket categorisations — all work cleanly.

2.5 · Custom Instructions

A persistent set of instructions that every conversation inherits — “I am a Chartered Accountant in India working under the Companies Act 2013 and SAs issued by ICAI; respond with that context, cite standards where applicable, use Indian English and ₹ for currency.” Set once, applied everywhere. Saves repetitive framing.

2.6 · Memory

ChatGPT remembers facts you tell it to remember across conversations — “I work in a 12-partner firm in Bengaluru, our biggest engagement is in the manufacturing sector, we use Tally Prime.” These persistent facts make every subsequent prompt more relevant. Memory can be turned off (and we recommend it stays off for any prompt that approaches client-specific data).

3 · What ChatGPT is not good at

  • Confident hallucination is its dominant failure mode. ChatGPT will produce plausible-looking citations to non-existent SA paragraphs, fictional CARO clauses, made-up sub-sections of the Companies Act. The fluency makes verification harder — what looks like a clean answer can be subtly wrong.
  • Long-document work is weaker than Claude. The free tier context window is meaningfully smaller. For dropping in a full SA or a 60-page contract, Claude or a long-context tool is a better fit.
  • Indian regulatory currency is uneven. Generic SAs and Ind AS coverage is solid, but the very latest ICAI notifications or CBDT circulars may be missing depending on the model’s knowledge cutoff. For currency, pair with Perplexity or check the official source.
  • Voice can drift into corporate-fluffy. Out of the box, ChatGPT tends toward longer-than-needed outputs. Aggressive prompting (“respond in 5 bullet points, no preamble”) tightens this.

4 · Specific features worth knowing

  • ICAI CA-GPT. Free for ICAI members (20 prompts/day) or INR 499/month for unlimited. Accessible at ai.icai.org/cagpt. For most standards-grounded Indian audit questions, start here before any other tier of ChatGPT.
  • GPTs marketplace. Search the GPT Store for “audit”, “Indian CA”, “GST”. Some community-built GPTs (like CA Mohit Gaba’s GST Guide GPT or CA Bina Shah’s TAXGPT) cover specific niches well. Treat them as starting points, not authority.
  • Custom Instructions. Set under Settings → Personalisation. A two-paragraph block describing you (your firm, your engagement type, your typical client size) applies to every conversation.
  • Memory. Same area. Useful for ongoing context, dangerous if it remembers anything client- identifying. Default to off for engagement work; on for firm-level methodology.
  • Code Interpreter / Advanced Data Analysis. Plus tier and above. Upload synthetic / anonymised CSVs, ask for analytical work, download results.
  • Voice mode. Plus tier. Useful for hands-free walkthrough of a standard during a long drive or commute. Don’t voice-prompt anything client-specific.
  • Search / browsing. Available in free and paid. Helpful for very recent regulatory updates, less reliable than Perplexity for the same task.

5 · Use by audit phase

Fit map. Strong fits in bold.

  • Planning. Strong fit. Industry brief generation, materiality discussion, audit strategy outline. CA-GPT does this especially well.
  • Risk assessment. Strong fit. ROMM brainstorming, fraud schemes, control-design suggestions.
  • Sampling. Usable. Methodology defence; sample-size math is better done in Code Interpreter or Excel.
  • Substantive testing — pattern detection. Usable via Code Interpreter on small / anonymised samples. Audit-grade tools like MindBridge serve full-population scoring better.
  • Vouching, reconciliations, cut-off. Usable. Particularly Code Interpreter for matching across CSV uploads.
  • CARO drafting. Strong fit. Clause-wise wording, especially when paired with the CARO- focused GPTs in CA-GPT.
  • Communications and drafting. Strongest fit. Engagement letters, MRLs, SA 260 communications, management letters.
  • Concluding work. Not used. The opinion belongs to the partner.

6 · Prompts that play to ChatGPT’s strengths

See the Audit Prompt Library for the broader set. A few that work particularly well in ChatGPT:

Custom Instructions block for an audit-CA
About me:
I am a practising Chartered Accountant in India. My firm is mid-sized (10-30 partners) and our engagements are predominantly statutory audit under the Companies Act 2013, tax audit under Section 44AB, and internal audit under Section 138. We use Tally Prime for client data and Microsoft 365 for documentation.

How I want responses:
- Respond in Indian English. Use ₹ for currency, lakh/crore for figures.
- Cite the relevant SA / Ind AS / Companies Act section where applicable.
- Default to concise output — bullets where useful, no preamble.
- Where my question is ambiguous, ask one clarifying question rather than guess.
- Never use my client's name, PAN, GSTIN or any other identifying detail in your responses, even if I include it in the prompt — anonymise.
- If you don't know something, say so. Don't make up paragraph numbers or section references.
Brainstorming risks of material misstatement (SA 315)
For an Indian [SECTOR — e.g. wholesale auto-parts distribution] company with annual turnover in the ₹100-300 crore range, brainstorm the risks of material misstatement at the assertion level.

Cover:
1. Financial statement level risks (fraud risk, complex transactions, judgement-heavy estimates)
2. Account-level risks for each major balance sheet line item
3. Specific Indian-regulatory risks (CARO 2020 reportable items, Section 13(3) related-party concerns, IFC under 143(3)(i))

For each, name the relevant assertion (existence / completeness / accuracy / valuation / cut-off / classification) and the SA that governs the response.

No entity-specific data — methodology only.
Code Interpreter — flagging journal entry anomalies
I'm uploading an anonymised CSV of journal entries (columns: entry_no, date, account_dr, account_cr, amount, user_id, narration). For an Indian statutory audit under SA 240, flag entries that meet any of the following patterns:

1. Posted on Saturday, Sunday or a public holiday (assume 2025-26 Indian holidays)
2. Manual JVs by user IDs other than the regular accounting staff (I'll list them in chat)
3. Round-number entries above ₹1 lakh
4. Debit entries to revenue accounts
5. Entries reversed within 7 days

Return a Python notebook output with a table per pattern, plus a summary count. Don't compute on actual amounts — just flag and present.

7 · Tier comparison and data handling

Five tiers Indian auditors realistically encounter:

  • ChatGPT Free. Decent for methodology and drafting. OpenAI’s default position is that conversations may be used to improve models unless you opt out under Settings → Data Controls → Improve the model for everyone. Toggle this off before anything serious.
  • ChatGPT Plus (INR ~2,000/month). Same opt-out applies. Adds Code Interpreter, GPTs, longer context. Most CAs are on this tier.
  • ChatGPT Team (INR ~2,500/month/seat). Same as Plus, plus team workspace, plus OpenAI does not train on Team data by policy. This is the lowest tier with the “no training” guarantee.
  • ChatGPT Enterprise. Contracted no-training, full admin controls, longer context, advanced security. The tier most large CA firms or audit-software vendors actually adopt.
  • ICAI CA-GPT (free for ICAI members, 20 prompts/day; INR 499/month for unlimited). Runs on the OpenAI backbone but is built and curated by ICAI. The data-handling specifics are governed by ICAI’s own privacy policy — preferable for Indian-context queries that don’t involve any client data.

8 · Common gotchas

  • Hallucinated section / SA paragraph numbers. The single most common error. Always verify against the actual standard or section before citing in a working paper.
  • Outdated tax rates and thresholds. Section 44AB threshold, presumptive tax limits, TDS rates shift year to year. ChatGPT’s training cutoff may pre-date the current FY. Verify against CBDT before any rate-specific work.
  • Memory leak risk. If Memory is on, anything you mention in one conversation can surface in another. A throwaway “our audit of XYZ Pvt Ltd” can become a persistent fact. Default Memory to off for engagement work.
  • GPTs can have stale knowledge bases. Community-built GPTs may not have been updated for the current FY. Check when the GPT was last updated before relying on it for current-year work.
  • Voice and image features are not for client work. The voice and Vision features add processing layers that may have different retention behaviour. Stick to text for anything that approaches an engagement.

9 · Where to start, this week

  • Sign in to ICAI’s CA-GPT with your membership number. Run three standards-grounded questions you would otherwise have looked up.
  • On consumer ChatGPT, set up the Custom Instructions block (above). Toggle Data Controls off training, Memory off. This is your baseline configuration.
  • Pick one drafting task in your current engagement — engagement letter, MRL, SA 260 communication — and use ChatGPT for the first pass. Compare the time vs from-scratch.
  • If you’re on Plus, test Code Interpreter on a synthetic CSV of journal entries (anonymised copy of a prior-year file). See whether the SA 240 patterns it surfaces feel useful.
How to read this guide

CORAA does not endorse any specific AI tool. This guide describes how Indian CAs use the named product in audit work — what tends to work, what tends not to, and the practical considerations around client data. It is not an integration guide, an affiliate page, or a recommendation. You decide which tool fits your engagement.

Whichever tool you choose, the principles in the Practical Guide still apply: AI assists, the auditor decides. Keep identifiable client data off prompts that go to consumer tiers. Document AI use under SA 230. Verify every citation.

For official AI credentials and CPE-eligible programmes, refer to ICAI’s AI portal — AICA Level 1, AURA, and the AI Innovation Summit. CORAA AI Lab is a free practice environment, not a regulator substitute.

For real client data — built differently
CORAA is the AI engine built for Indian audit — India-hosted, DPDPA 2023 compliant, no training reuse.
Seven hubs covering the whole engagement: Setup → Scrutiny → Reconciliation → Procedures → Working Papers → Findings → Reporting. 164 scrutiny rules across 13 modules. SA 230, 240, 320, 450, 510, 530, 570, 700 baked into the workflow.
India-hosted
Every byte on Indian soil. Azure India regions for all production workloads.
DPDPA 2023 compliant
Data-fiduciary obligations built in by default. Not bolted on after the fact.
ISO 27001:2022 · SOC 2 Type II
Certified and attested. The security baselines enterprise audit committees actually ask for.
No training reuse
Client data never enters any foundation model. Contractual, not aspirational.
See CORAA in 20 minutesExplore the AI ModulesVisit the Trust Centre