Guides, copy-ready prompts, free working files and the standards, for internal audit teams, CA firms and finance heads in India. Start with the guide, pick your AI tool, then take the working file you need.
AI does two different jobs in internal audit in 2026. Chat assistants such as ChatGPT, Claude, Copilot in Excel and Gemini draft and structure: a risk and control matrix from a process narrative, walkthrough questions, a test step or a spreadsheet formula, an observation in five parts, a summary for the audit committee. Systems that apply fixed rules to every transaction in the books do the testing: duplicate payments, approvals outside limits, unusual journal entries, with each exception traced to its voucher. The first gives you a draft to verify. The second gives you a result you can run again and get the same answer.
What has not changed is who decides and who is responsible. Under Section 138 of the Companies Act, 2013 and Rule 13 of the Companies (Accounts) Rules, 2014, the audit committee or the Board, in consultation with the internal auditor, settles the scope, functioning, periodicity and methodology of internal audit. A chat assistant does not test a population and can invent a citation, so the internal auditor still owns the evidence, the rating and the conclusion. Personal data of employees, customers and vendors stays out of consumer AI tools unless you have authority to put it there.
One guide for each assistant an internal auditor is likely to have, plus two that apply to any of them: how to write a prompt that survives review, and how far a tool can go in writing the report.
An agent takes steps by itself instead of answering one question at a time. These guides cover what that means for the audit team, and how to audit agents and AI systems the company itself runs.
A prompt gives you a draft. These hold the checked result: the RCM, the sampling plan, the observation, the follow-up, and the record of where AI was used.
ICAI lists its Compendium of Standards on Internal Audit (as on February 2026) as applicable from 1 April 2026. Check the ICAI Internal Audit Standards Board compendium before you cite a standard number in a report or an engagement letter.
For the CFO, finance controller and audit committee member: cash, working capital, the month-end close and the exceptions worth an owner and a closure date. Testing every transaction for exceptions like these is what CORAA is built for; the files below work without it.
Looking for checklists, RCMs and audit programmes by process cycle? They are in the internal audit resources hub.
