Strip away the demos and every AI-in-audit question reduces to these. They are also, not coincidentally, the questions a peer reviewer or NFRA inspector will ask about machine-assisted work.
A finding that changes every time the tool runs cannot be defended in a peer review or an NFRA inspection — the reviewer will ask you to show how you got it. Whatever AI you use, the numbers, selections and exceptions must come from deterministic computation you can re-run; the model layer belongs on top, explaining, never underneath, computing. Ask any vendor: "if I run the same engagement twice, do I get the same answer, byte for byte?"
SA 200 places the opinion on the auditor, and no standard carves out an exception for machine assistance. In practice that means AI may draft, rank, summarise and suggest — and the auditor concludes. The cleanest discipline: AI never writes a figure into a working paper. Amounts come from the books through computation; the model writes only the words around them, and even those get reviewed.
Client books are stuffed with personal data — employee payroll, director PANs, customer ledgers — and the DPDP Act 2023 applies to it. Before any ledger leaves your office, know where the tool processes and stores data, whether it trains on your clients’ books, and whether hosting is in India. The Code of Ethics confidentiality duty (and your engagement letter) applies to a model API exactly as it applies to an article assistant.
Drafting emails faster is nice; the structural change is that software reads 100% of the population. Sampling exists because humans cannot read fifty thousand vouchers — machines can, and then surface the entries that deserve judgment: unusual journal combinations, round-sum month-end entries, related-party patterns, Benford deviations. SA 530 sampling still has its place, but risk assessment on the full population is a materially stronger base for it.
SA 230 asks for documentation that lets an experienced auditor understand what was done and why. When AI assists, record what ran, on what data, what it flagged, and what you did with each flag. If the vendor disappeared tomorrow, your working-paper file should still tell the whole story — exports, locked papers, and the trail of who reviewed what.
Take these to any vendor demo — including ours. A “no” on any row is a finding waiting to happen.
| Ask | Why it decides |
|---|---|
| Same input, same output? | Re-runs must reproduce byte-identically — the peer-review and NFRA test. |
| Who writes the figures? | Amounts should be computed from the books, never generated by a model. |
| Can every number drill to a voucher? | Auditors trust vouchers, not indicators. A metric with no drill-down is an assertion, not evidence. |
| Where does the data live? | India hosting, no training on client data, DPDP-compatible processing. |
| Does the file export and lock? | Working papers must survive outside the tool — locked, dated, reviewable. |
| Does it suggest or decide? | Good tools surface and explain; the conclusion box belongs to the auditor. |
CORAA is built as our answer to this table — deterministic computation underneath, AI narration on top, every number drilling to its voucher. See the AI Modules or start free: your first audit is on us. See also audit software in India — what to actually evaluate for how this maps onto the wider tooling landscape.
Yes. The Standards on Auditing are technology-neutral — nothing in the SAs (or the expected IndSAs) prohibits machine assistance, and ICAI itself is building AI tooling for members. What the standards do fix is responsibility: the auditor signs, so the auditor must be able to reproduce, evaluate and document whatever the tool contributed (SA 200, SA 230).
The evidence points the other way: AI is absorbing the reading — scanning full ledger populations, drafting schedules, reconciling registers — while the concluding remains human because the law puts the signature, the skepticism and the liability on a member. The realistic risk is competitive, not existential: firms that audit with full-population tooling will out-deliver firms that sample by hand at the same fee.
CA GPT (ai.icai.org) is ICAI’s free conversational AI for members and students — annual-report analysis, financial ratios, exam support — reportedly past 5 lakh users in 2026. ICAI has also partnered with Sarvam AI on audit quality, trained 50,000+ members in AI, and launched the AICA certification (now Level 3). It is a research assistant, not an audit tool: it does not connect to client books or produce working papers.
Only if they are reproducible and reviewed. A reviewer will test three things: can the firm regenerate the paper and get the same result; do the figures trace to the books; and did a member actually review and conclude. Papers that pass those tests are fine regardless of what drafted them; papers that fail them are indefensible even if a human typed every word.
Judge any tool — including ours — against the evaluation checklist above: deterministic re-runs, computed (never generated) figures, voucher-level drill-down, India hosting, exportable locked files, and suggestions rather than verdicts. CORAA is our answer to that checklist for Indian statutory audit — Tally-native, full-population scrutiny, Schedule III / CARO / 3CD reporting — and your first audit on it is free, which is the honest way to evaluate.
Start narrow and data-first: pick one completed engagement whose books you know, run it through the tool, and compare its output against what the team concluded by hand. Automate the reading layers first — ledger scrutiny, reconciliations, ageing, lead schedules — and keep partner review gates exactly where they are. Document the tool’s role in the file under SA 230 from engagement one, train the team on evaluating flags rather than clearing them, and only then scale across the client list. Budget for the checklist above before price.
ICAI facts sourced from ai.icai.org and 2026 AI Innovation Summit coverage; standards status from NFRA/MCA reporting — verify current notification status before citing dates in a report.
