There is no shortage of software for audit and tax work, and more of it now says it uses AI. None of the Standards on Auditing names a tool or tells a firm which to buy. What the Standards and the Chartered Accountants Act do is set the tests that any tool's output has to pass once it is relied on in an audit file.
This checklist turns those tests into questions. It names no product. Apply it to anything.
1. Where the client's data goes
The Second Schedule to the Chartered Accountants Act, 1949 treats as professional misconduct a member who "discloses information acquired in the course of his professional engagement to any person other than his client so engaging him, without the consent of his client or otherwise than as required by any law for the time being in force" (Part I, clause (1)).
Uploading a client's books to a service is not, by itself, a disclosure. But the obligation is the member's, and it does not pass to a vendor because the vendor is careful. So the questions come first:
- Where is the data stored and processed, and in which country?
- Is any of it sent to a third-party AI model or service? Which one, and under what terms?
- Who can open it, and is there a record of who did?
- Can the firm take its data out, and have it deleted, when it leaves?
The same questions are now being asked of clients' own systems. Clause 14 of Form No. 26 asks for the accounting software used, any cloud or other storage with its IP address and country, and the address of the backup server in India, and CBDT's FAQ 18 ties that to Rule 46's requirement that electronic books remain accessible in India with a daily backup there.
2. Whether its output can be relied on
SA 500 requires the auditor, when using information produced by the entity, to evaluate whether it is sufficiently reliable for the auditor's purposes, including obtaining evidence about its accuracy and completeness. A tool that reads the books does not remove that step; a good one makes it possible.
- Does it read the books directly, or work from an export? If an export, does it record which one?
- Does it prove the read is complete, for example by agreeing its figures to the trial balance of the books it read?
- Can it show the completeness and accuracy of a listing it hands you, such as a ledger extract or a list of exceptions?
3. Whether a reviewer can follow it
SA 230 requires audit documentation sufficient for an experienced auditor, with no previous connection with the audit, to understand the nature, timing and extent of the procedures, the results and evidence obtained, and the significant matters, conclusions and judgements.
- Does every figure open down to the vouchers or entries behind it?
- Are overrides and judgements logged with who made them and when?
- Do the working papers export in a form that stays in the firm's file, readable without the tool?
4. What it actually tested
SA 530 applies when the auditor decides to use sampling. A tool that tests whole populations and a tool that samples are both legitimate, but the file has to say which one happened.
- Does each test state the population it covered, or the sample and how it was chosen?
- Are thresholds applied to every transaction in that population, or only to what was selected?
5. Whether it applies the right law to the right year
The Income-tax Act, 2025 governs tax years from 1 April 2026, and Form No. 26 replaces Form 3CD from tax year 2026-27, while audits of earlier years remain under the 1961 Act.
- Are the rules keyed to the financial year, so an earlier year is still tested under the law that applied to it?
- Does each test cite the section it applies, under the Act that governs that year?
6. If it uses AI
Everything above applies to generated output, and three questions are specific to it:
- Does every generated statement show the source it came from?
- Does it say when it does not know, instead of producing a fluent answer?
- Does the same input give the same output, so that a reviewer can reproduce what the file relies on?
Score a tool
Tick what the vendor can show you, not what the brochure says
The questions follow the Chartered Accountants Act, 1949 and SA 500, SA 230 and SA 530. They name no product. Your ticks stay on this page.
Using the score
A tick means the vendor showed it, on your data or on a walkthrough, not that a brochure said it. The questions left unticked are the ones to take back to the vendor in writing.
Questions this answers
What should a CA firm check before using an AI tool on client data?
Where the data is stored and processed, whether any third-party AI model receives it, who can access it, and how it is exported and deleted, because disclosing client information without consent is misconduct under the Chartered Accountants Act.
Do the Standards on Auditing require audit software?
No. They set requirements, such as SA 500 on the reliability of information and SA 230 on documentation, that apply to a tool's output once the auditor relies on it.
How does SA 230 apply to audit automation?
The documentation must let an experienced auditor with no previous connection to the audit understand what was done, the results and the significant matters, so a tool's output needs to be traceable and exportable into the file.
What should an AI audit tool show with its answers?
The source for each statement, a clear signal when it does not know, and the same answer for the same input, so a reviewer can reproduce it.
Where Audcrix runs this
- Ledger Analysis — Read every Tally ledger and voucher without opening a port, reconcile the read against Tally's own trial balance, and classify each ledger by its group chain.