Search for “AI tools for statutory audit” and you will find a page of audit software vendors, each describing ledger scrutiny of every transaction and auto-drafted working papers. What you will rarely find is the regulator’s view. That changed in July 2026, when the National Financial Reporting Authority published the first paper in its Staff Series on Technology in Audit.

I have read it as someone who has signed off audit work and now helps firms adopt AI. Here is what it asks of auditors, and how I would turn it into a working policy for a CA firm choosing a tool.

What the NFRA paper covers

The NFRA paper, General Principles for Technology Adoption in Audit, is principles-based and technology-neutral. It covers data analytics, automated tools and techniques, machine learning, generative AI and agentic AI, whether built in-house, licensed from a vendor or embedded in a network methodology. It is written for statutory auditors of public interest entities, but the principles restate obligations that already exist under the Standards on Auditing, so smaller firms would be wise to read it as a description of good practice.

Its ten principles include non-delegable auditor responsibility, applying the same evidence standard to tool output as to any other source, actively preserving professional scepticism, proportionate governance, explainability in line with materiality, and governance before deployment.

Five points that change how a firm buys a tool

  • The opinion belongs to the auditor. A tool can inform judgement but cannot be used to explain away a wrong conclusion.
  • Tool output is evidence only after its relevance and reliability are evaluated, as SA 500 requires for any source.
  • Fluent output invites automation bias. Reviewers must consciously challenge it, not just tick it.
  • Validation should be proportionate: a translation aid and an agentic tool that selects and tests samples need different scrutiny.
  • Tools must be validated and approved before use on a live engagement, not reviewed after the event.

Questions to ask an audit software vendor

  • Which procedures does the tool perform, and which does it only suggest?
  • How are classification and anomaly rules defined, and can we see and change them?
  • Is the output reproducible if we run the same data twice?
  • What does the tool record for our working papers, and in what format can we export it?
  • Where is client data stored and processed, who can access it, and is it used to train any model?
  • How are product changes notified, so we can revalidate after material updates?

Client data is still the firm’s responsibility

The NFRA paper is explicit that client and personal information must be protected in line with the firm’s confidentiality obligations and the Digital Personal Data Protection Act, 2023, and that a firm cannot rely on a vendor’s terms of service without validation. In practice this means a short due-diligence file for each tool: hosting location, access controls, retention, sub-processors and breach notification terms.

Skills, not just software

The profession is building capacity quickly. At its AI Innovation Summit 2026, ICAI said it had trained over 50,000 members in AI and launched an advanced certification. That helps, but the NFRA principles point to a narrower skill every engagement team needs: the habit of asking how a tool reached an output before relying on it.

For working papers specifically, my guide to AI for audit working papers in India sets out what to automate and what must stay human, and the CARO 2020 note applies the same thinking to reporting.

A one-page tool policy for a CA firm

  • An approved-tools register with the risk tier of each tool and its validation record.
  • Rules for what each tier may be used for on an engagement.
  • Documentation: what must be retained in the file when a tool’s output is relied on.
  • Review: who challenges tool output and how that challenge is evidenced.
  • Revalidation triggers: vendor updates, new data sources, or a change in how the tool is used.

Frequently asked questions

Does NFRA allow AI in statutory audits?

Yes. NFRA’s July 2026 paper neither mandates nor prohibits any tool. It sets principles: the auditor remains responsible, tool output must meet the usual evidence standard, and tools must be validated before use on live engagements.

Do the NFRA principles apply to smaller CA firms?

The paper is addressed to statutory auditors of public interest entities, but it restates obligations already in the Standards on Auditing, so it is a useful benchmark for any firm.

What should a firm check before buying AI audit software?

Which procedures the tool performs, how its rules work, whether output is reproducible, what it records for working papers, where data is stored and used, and how updates are notified for revalidation.

What is automation bias in audit?

The tendency to accept fluent, plausible machine output with less challenge than a human-prepared equivalent. NFRA asks engagement teams and reviewers to counter it consciously.

Related reading

Sources

Disclaimer: this article is general educational commentary. It is not legal, tax, audit or data-protection advice and does not create an adviser–client relationship. Laws, standards and thresholds change; check the current official text and take professional advice on your facts before acting.