# AI for Audit Working Papers in India: What a CA Should Automate and What Must Stay Human

> Using AI on audit working papers without weakening SA 230 documentation: what to automate, what stays with the engagement team, and how to record AI use.

Canonical: https://pratikbajoria.com/blog/2026-09-30-ai-for-audit-working-papers-in-india-what-a-ca-should-automate-and-what-must-stay-human
Last updated: 2026-10-22

CA insights · 2026-09-30 · Updated 22 Oct 2026 · 9 min read

Using AI on audit working papers without weakening SA 230 documentation: which tasks to automate, which judgements stay with the engagement team, and how to document AI use on the file.

Key takeaways

- SA 230 still requires documentation an experienced auditor with no previous connection to the audit can understand, whether or not AI drafted part of it.
- Automate mechanical work: PBC tracking, indexing and cross-referencing, tying lead schedules to the trial balance, field extraction and narratives of work already performed.
- Keep human: risk assessment, materiality, sufficiency of evidence, sampling rationale, evaluation of misstatements and going concern.
- Add a short AI-use block to each paper a tool touched: tool and version, input, output, reviewer and what the reviewer changed.
- Since 1 April 2023, companies must use accounting software with an audit trail and edit log for every transaction.

In July 2026 the National Financial Reporting Authority published its first staff paper on technology in audit, and its message to auditors of public interest entities was blunt: a tool can speed up judgement, but the [responsibility for the audit opinion remains with the auditor](https://cdnbbsr.s3waas.gov.in/s3e2ad76f2326fbc6b56a45a56c59fafdb/uploads/2026/07/202607231927160337.pdf), however sophisticated the tool. For anyone preparing working papers with AI this busy season, that changes the question from “can the tool do it?” to “can the file prove a person did the thinking?”

My own test, before I look at any tool, is the one SA 230 already sets: could an experienced auditor who has never seen this engagement pick up the file and understand what was done, what was found and why the team concluded what it did? AI is very good at producing text that looks like a working paper. That is the danger. A fluent narrative that nobody performed, or a tie-out nobody checked, makes a file look complete while hollowing out the evidence underneath it.

## What SA 230 actually asks of the file

Paragraph 8 of SA 230 requires documentation sufficient to enable an experienced auditor, having no previous connection with the audit, to understand the nature, timing and extent of procedures performed, the results and evidence obtained, and significant matters, conclusions and professional judgements. Paragraph 9 requires recording who performed the work and when, and who reviewed it, when and to what extent. The application material notes that assembly of the final audit file is [ordinarily completed not more than 60 days after the date of the auditor’s report](https://cpeapp.icai.org/downloadBGM/5b39b17b010f9.pdf).

None of that is suspended because a model drafted part of the paper. If anything, AI raises the bar on the “who performed” and “who reviewed” lines, because the honest answer now has three parties: the person, the tool, and the reviewer.

There is a second trail to keep in mind. For companies, the proviso to Rule 3(1) of the Companies (Accounts) Rules, 2014 has, since 1 April 2023, required [accounting software with an audit trail and an edit log for every transaction](https://cajournal.icai.org/article-details/mandatory-audit-trail-step-towards-greater-transparency). If an AI tool prepares entries or schedules that end up in those books, the working paper should let a reviewer connect the two.

## What NFRA’s July 2026 principles add

NFRA’s [General Principles for Technology Adoption in Audit](https://cdnbbsr.s3waas.gov.in/s3e2ad76f2326fbc6b56a45a56c59fafdb/uploads/2026/07/202607231927160337.pdf) (Staff Series on Technology in Audit: 01, published 23 July 2026) sets out 10 principles. It says plainly that none of them is new: each restates an obligation already in the Standards on Auditing, the quality control standards or the ethical rules, applied to technology. Four of them bear directly on working papers:

- **Non-delegable responsibility (Principle 2).** The opinion is the auditor’s, whatever produced the analysis behind it.
- **Evidence standards apply regardless of source (Principle 3).** Tool output is held to the same sufficiency and appropriateness test as manual work.
- **Explainability commensurate with materiality (Principle 6).** The more an output drives a material conclusion, the more the file must explain it, and the paper ties this expressly to documentation under SA 230.
- **Continuous monitoring, not one-time approval (Principle 10).** Because the same input can give a different result on a different day, approving a tool once is only the starting point.

Principle 8, data stewardship, adds that a firm cannot rely on a vendor’s terms of service, without validating them, as a substitute for its own duty to protect client and personal data under its confidentiality obligations and the DPDP Act, 2023. The paper is addressed to auditors of public interest entities, but I would treat it as the benchmark for any firm whose files may one day be read by a regulator.

## What I would automate

The work worth automating is mechanical, checkable and repetitive:

- **PBC tracking and indexing.** Matching client uploads to the request list, naming files consistently, flagging what is missing.
- **Lead schedules and tie-outs.** Mapping the trial balance to lead schedules and flagging differences — work that is easy to re-perform and verify.
- **Extraction for vouching support.** Pulling dates, amounts and parties from invoices, confirmations and agreements into a schedule, with the source document linked on every row.
- **Reading aids.** Summarising board minutes or long contracts to direct attention — not to replace reading the relevant sections.
- **Drafting narratives of completed work.** Turning a senior’s notes on procedures already performed into a clean working-paper narrative, which the senior then checks line by line.

## What must stay human

Risk assessment and materiality. The judgement on whether evidence is sufficient and appropriate. The rationale for sampling approaches, even if a tool generates the selection. Evaluation of misstatements. Going-concern and key judgement areas. Communication with management and those charged with governance. Review and sign-off. These are the places where the file has to show professional judgement, and SA 230 expects significant judgements to be documented as judgements made by the engagement team.

Illustrative split for a statutory audit working file. Adapt to your firm’s methodology and quality policies.

| Working-paper task | Automate? | Human responsibility | Evidence to keep on file |
| --- | --- | --- | --- |
| PBC tracking and indexing | Yes | Senior confirms completeness of the request list | Tracker with dates and source links |
| TB to lead schedule tie-out | Yes | Preparer investigates every difference flagged | Tie-out with differences and resolutions |
| Field extraction from invoices and confirmations | Yes, with source links | Preparer checks a sample back to documents | Extraction schedule, tool used, sample check noted |
| Sample selection | Tool may generate | Team sets population, method and rationale | Parameters, output and rationale |
| Minutes and contract summaries | As a reading aid | Team reads relevant sections in full | Note of what was read and matters identified |
| Risk assessment, materiality, conclusions | No | Engagement team and partner | Documented judgements and review evidence |

## The file clock: where AI can and cannot help

AI is often pitched as a way to “tidy up the file” after signing. SA 230 is precise about what is allowed once the report is dated, so it is worth setting the timeline out. Paragraph references are to the [ICAI text of SA 230](https://live.icai.org/bos/vcc-2nd-batch-recorded-lectures/pdf/SA%20230%20-%20Audit%20Documentation.pdf).

SA 230 timeline for the audit file, and what it means for AI-assisted tidying.

| Stage | What SA 230 requires | Reference |
| --- | --- | --- |
| Before the report is signed | All audit procedures, evidence and conclusions documented; AI-assisted papers reviewed and signed off | SA 230, paras 8–11 |
| Within ordinarily 60 days of the report date | Assembly of the final audit file: only administrative changes such as sorting, cross-referencing and deleting superseded drafts | SA 230, para 14 and A21–A22 |
| After assembly | Nothing may be deleted or discarded before the retention period ends | SA 230, para 15 |
| Any later change | Record the specific reasons, and when and by whom the change was made and reviewed | SA 230, para 16 |
| Retention | Ordinarily no shorter than seven years from the date of the auditor’s report (or the group auditor’s report, if later) | SA 230, para A23; SQC 1 |

The practical rule follows from it. AI can help with assembly work, such as indexing, cross-referencing and spotting superseded drafts, because that is administrative. It must not be used after the report date to write up procedures that were never documented, because that would be new documentation of work, which SA 230 treats very differently.

## Documenting AI use without drowning in it

Firms tend to swing between two extremes: no record of AI use at all, or a policy so heavy that people quietly stop disclosing it. I prefer a short, standard block on any working paper where a tool contributed: the tool and version, what it was given, what it produced, who reviewed it, when, and what they changed. That is enough for a reviewer to reconstruct the work, and it fits naturally alongside the preparer and reviewer sign-offs SA 230 already expects.

Keep prompts that are reused across engagements in a controlled library, with an owner and change notes. When a prompt changes, the output changes; a reviewer should be able to see which version produced which paper. The NIST AI Risk Management Framework is a sensible reference for this kind of proportionate logging.

## Confidentiality and client data

Audit files contain some of the most sensitive information a client has: unpublished results, payroll, related-party dealings, legal matters. Consumer chatbot accounts are not an approved environment for that material. Use tools your firm has assessed for data processing, storage location, retention and access control. Where working papers include personal data — payroll and KYC are obvious examples — the Digital Personal Data Protection Act, 2023 expects the business to protect it with reasonable security safeguards, including when a processor handles it on its behalf. Your professional confidentiality obligations under ICAI’s framework apply regardless of which tool you choose.

The rules have also firmed up. The DPDP Rules, 2025 were [notified in November 2025](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190014), with most obligations phased in over 18 months, so treat this as current compliance, not a future project.

For audits within NFRA’s remit, expect files to be read closely by people who were not on the engagement. That is precisely the reader SA 230 has in mind.

## A sensible first quarter

Pick two or three engagements with cooperative clients and stable systems. Automate PBC tracking and lead-schedule tie-outs first. Add extraction for vouching support with a documented sample check. Introduce the standard AI-use block on every paper a tool touched. At the end of the quarter, ask a manager from a different team to read one file cold. If they can follow it, extend. If they cannot, the problem is the file, not the reviewer.

Timing matters too. For AY 2026-27 the CBDT has [moved the specified date for tax audit reports from 30 September to 21 October 2026](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2316640), which pushes tax audit work into the weeks many firms are also closing statutory files. A pilot that adds review steps in that window has to be planned for it, not discovered in it.

For the full CA implementation map, see the [AI for chartered accountants in India](https://pratikbajoria.com/blog/ai-for-chartered-accountants-in-india) hub. Related pieces: [using AI for GST reconciliation without risking client data](https://pratikbajoria.com/blog/2026-09-28-how-indian-ca-firms-can-use-ai-for-gst-reconciliation-without-risking-client-data), [AI tools for chartered accountants](https://pratikbajoria.com/blog/best-ai-tools-chartered-accountants-finance-professionals) and [when to say no to an AI pilot](https://pratikbajoria.com/blog/2026-09-24-when-a-finance-team-should-say-no-to-an-ai-pilot). To see where AI fits across your practice, start with the free [AI Opportunity Scorecard](https://pratikbajoria.com/scorecard), look at the scoped [AI Opportunity Audit](https://pratikbajoria.com/audit), or [book a discovery call](https://pratikbajoria.com/#contact).

## Monday-morning checklist

- Pick two or three engagements and name the manager accountable for the AI trial.
- Automate PBC tracking and lead-schedule tie-outs before anything judgement-heavy.
- Add source links to every extracted row and document a sample check.
- Adopt a standard AI-use block: tool, input, output, reviewer, date, changes.
- Keep client files out of consumer chatbot accounts; confirm vendor data terms.
- At quarter end, have someone outside the team read one file cold.
- Re-approve each tool after a material model or vendor change, as NFRA’s Principle 10 expects.
- Diary the 60-day file-assembly deadline for every signed report and lock the file once it is assembled.

## Frequently asked questions

### Does using AI on an audit change what SA 230 requires?

No. SA 230 still requires documentation sufficient for an experienced auditor with no previous connection to the audit to understand the procedures performed, the evidence obtained and the significant judgements made. AI-assisted work has to meet the same test, which usually means recording how the tool was used and who reviewed its output.

### Which audit tasks are safest to automate first?

Administrative and mechanical work: PBC tracking, indexing and cross-referencing, tying lead schedules to the trial balance, extracting fields from confirmations and invoices, and drafting narratives of work already performed. These are easy to check and do not replace judgement.

### Can AI select audit samples?

Tools can generate selections, but the sampling approach, the population, and the rationale remain the engagement team’s responsibility and should be documented as such. Keep the parameters and the output on file so the selection can be re-performed.

### How should I document AI use on the working paper?

Note the tool and version, the input it was given, the output, who reviewed it and when, and what the reviewer changed. Keep it short, but make it possible for a reviewer to reconstruct what happened.

### What does NFRA’s July 2026 guidance say about AI in audits?

NFRA’s staff paper on General Principles for Technology Adoption in Audit (July 2026) sets out 10 principles. Auditors may use AI and data analytics, but responsibility for the opinion stays with the auditor, tool output must meet the same evidence standards as manual work, explainability must match materiality, and tools need continuous monitoring rather than one-time approval.

### How long after the audit report must the file be assembled, and how long is it kept?

Under SA 230 and SQC 1, the final audit file should ordinarily be assembled not more than 60 days after the date of the auditor’s report, and retained for no shorter than seven years from that date, or from the group auditor’s report if later.

## Keep reading in this topic

This guide is part of [AI for Chartered Accountants in India: the implementation hub](https://pratikbajoria.com/blog/ai-for-chartered-accountants-in-india).

- [AI for Internal Audit in Indian Companies: A Practical Starting Point](https://pratikbajoria.com/blog/2026-10-08-ai-for-internal-audit-in-indian-companies-a-practical-starting-point)
- [AI for Tax Audit in India: Form 3CD This Year, Form 26 Next Year](https://pratikbajoria.com/blog/2026-10-09-ai-for-tax-audit-in-india-form-3cd-this-year-form-26-next-year)
- [How Indian CA Firms Can Use AI for GST Reconciliation Without Risking Client Data](https://pratikbajoria.com/blog/2026-09-28-how-indian-ca-firms-can-use-ai-for-gst-reconciliation-without-risking-client-data)
- [AI controls checklist for CA firms in India](https://pratikbajoria.com/blog/ai-controls-checklist-ca-firms-india)
- [DPDP Act and AI in CA firms: a client-data decision rubric](https://pratikbajoria.com/blog/2026-10-19-dpdp-act-and-ai-in-ca-firms-in-india-a-client-data-decision-rubric)

Also useful: [AI implementation for finance teams: the CFO and controller guide](https://pratikbajoria.com/ai-implementation-for-finance-teams).

## Sources

- [ICAI — SA 230, Audit Documentation (text of the Standard)](https://live.icai.org/bos/vcc-2nd-batch-recorded-lectures/pdf/SA%20230%20-%20Audit%20Documentation.pdf)
- [ICAI — Implementation Guide to SA 230, Audit Documentation (Revised 2022 Edition)](https://publication.icai.org/publication/375)
- [NFRA — General Principles for Technology Adoption in Audit (Staff Series on Technology in Audit: 01, July 2026)](https://cdnbbsr.s3waas.gov.in/s3e2ad76f2326fbc6b56a45a56c59fafdb/uploads/2026/07/202607231927160337.pdf)
- [NFRA — Staff Series on Technology in Audit (published 23 July 2026)](https://nfra.gov.in/staff-series-on-technology-in-audit/)
- [Digital Personal Data Protection Act, 2023 (Gazette text, MeitY)](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf)
- [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework)
- [ICAI — Implementation Guide to SA 230, Audit Documentation](https://cpeapp.icai.org/downloadBGM/5b39b17b010f9.pdf)
- [The Chartered Accountant journal (ICAI) — Mandatory audit trail](https://cajournal.icai.org/article-details/mandatory-audit-trail-step-towards-greater-transparency)
- [PIB — Government notifies DPDP Rules (14 November 2025)](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190014)
- [PIB — CBDT extends AY 2026-27 due dates for audited taxpayers (29 September 2026)](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2316640)

*Disclaimer: this article is general educational commentary from implementation work. It is not tax, legal, audit or data-protection advice, and it does not create an adviser–client relationship. GST procedures, portal functionality, Standards on Auditing and data-protection rules change; check the primary sources and take professional advice on your specific facts before acting.*

*Educational content; not financial, investment, or legal advice.*

## Related
- [AI for chartered accountants in India](https://pratikbajoria.com/blog/ai-for-chartered-accountants-in-india)
- [using AI for GST reconciliation without risking client data](https://pratikbajoria.com/blog/2026-09-28-how-indian-ca-firms-can-use-ai-for-gst-reconciliation-without-risking-client-data)
- [AI tools for chartered accountants](https://pratikbajoria.com/blog/best-ai-tools-chartered-accountants-finance-professionals)
- [when to say no to an AI pilot](https://pratikbajoria.com/blog/2026-09-24-when-a-finance-team-should-say-no-to-an-ai-pilot)
- [AI Opportunity Scorecard](https://pratikbajoria.com/scorecard)
- [AI Opportunity Audit](https://pratikbajoria.com/audit)
- [AI for Internal Audit in Indian Companies: A Practical Starting Point](https://pratikbajoria.com/blog/2026-10-08-ai-for-internal-audit-in-indian-companies-a-practical-starting-point)
- [AI for Tax Audit in India: Form 3CD This Year, Form 26 Next Year](https://pratikbajoria.com/blog/2026-10-09-ai-for-tax-audit-in-india-form-3cd-this-year-form-26-next-year)
- [All articles](https://pratikbajoria.com/blog)