AI in Audit: What a Chartered Accountant Can Rely On, and What NFRA and the Standards Still Demand

Somewhere this week, an article in a CA firm will paste a trial balance into an AI chatbot and ask it which ledgers look unusual. The answer will come back in seconds. It will be fluent, confident and nicely formatted. And the question for the partner who signs the audit report is the one the profession has asked of every new tool since the first spreadsheet: can I rely on this?

The standards have an answer, and this year the regulator wrote it down.

What NFRA said in July 2026

In July 2026, the National Financial Reporting Authority published the first of a staff series on technology in audit, "General Principles for Technology Adoption in Audit". It is addressed to the statutory auditors of public interest entities, but its logic reaches every audit. It is careful about its own status. It is a staff document, not a circular, and it says it is not a policy, standard or recommendation of the Authority. But it says something just as important: its principles "are not new". Each one "reiterates or clarifies an obligation that already exists" under the Standards on Auditing, quality control and ethics.

Three sentences from it deserve to be on every partner's wall:

• "The responsibility for the audit opinion remains with the auditor, irrespective of the sophistication of the tools used."
• Output from a tool can be audit evidence "only once its relevance and reliability have been evaluated by the auditor… There is no separate, lower evidentiary bar for technology-generated information."
• "Technology cannot be expected to exercise professional scepticism on the auditor's behalf."

The trap has a name now

The revised Code of Ethics, whose 13th edition applies from 1 April 2026, gives the risk a name: automation bias, "a tendency to favor output generated from automated systems, even when human reasoning or contradictory information raises questions as to whether such output is reliable or fit for purpose". NFRA's paper describes the same thing plainly. Fluent, well-presented output invites less challenge than a human-prepared working would get.

The Code adds a new requirement, R320.11. When a chartered accountant intends to use the output of technology, they "shall determine whether the use is appropriate for the intended purpose". The factors include whether the accountant can understand and explain the technology, and whether it has been tested for that purpose.

What the Standards on Auditing already demand

None of this needed new standards. It was already there.

• SA 500, paragraphs 7 and 9. Consider the relevance and reliability of any information used as evidence, and for information produced by the entity, get evidence of its completeness and accuracy. A tool is only as reliable as the data it was given.
• SA 230, paragraph 8. Documentation must let "an experienced auditor, having no previous connection with the audit" understand what was done, what was found and what was concluded. "The tool said so" isn't documentation.
• SA 200, paragraph 15. Professional skepticism. A chatbot doesn't have any.
• SA 330 and SA 530. Technology can test a whole population rather than a sample. SA 330 says so, and SA 500 recognises 100% examination. NFRA's Don'ts add the catch: full-population testing does not remove the need for a risk assessment.

India's SA 315 remains the 2008 standard. The revised text with paragraphs on automated tools has not been adopted here, so it isn't a requirement yet.

The confidentiality line

The oldest rule matters most. Under the Chartered Accountants Act, 1949, Second Schedule, Part I, clause (1), a CA in practice is guilty of professional misconduct if they disclose information acquired in the engagement "to any person other than his client… without the consent of his client". A client's ledger typed into a public tool is information leaving the engagement.

NFRA's paper is explicit. Use of any tool "must not result in client information being processed or retained outside the auditor's or audit firm's controlled environment". A firm cannot rely on a vendor's terms of service in place of its own duty.

The question is not whether AI is allowed in an audit. It is whether the auditor can still say, of every conclusion, that it is theirs.

Before you rely on it

Where the profession is going

ICAI has built an AI committee and a certificate programme, AI for Chartered Accountants, run in levels since 2024. The quality-management standards, SQM 1 and SQM 2, would require firms to make sure their technological resources are fit for purpose and confidential. Their mandatory date was deferred by ICAI on 31 March 2026, and SQC 1 continues to apply for now. The direction is clear either way. Firms will be expected to know which tools their people use, and to prove those tools are fit for the work.

Where this comes from

The regulator's view is NFRA's Staff Series on Technology in Audit 01 (July 2026), a staff document that reiterates existing obligations. The requirements are the Standards on Auditing (SA 200, 230, 330, 500 and 530), SQC 1, SQM 1 (not yet mandatory), the Code of Ethics (13th edition, 2026), and the Chartered Accountants Act, 1949. This page names no tool or vendor, and applies the same questions to all of them.