We use cookies to understand which pages and tools are useful, nothing more — no ad tracking across other sites. You can change this later from the footer.
Resources
Not a blog. Reference material that solves a real problem on an engagement, whether or not you ever become a customer. Everything here is free and ungated.
Purchase & AP audit
Testing the purchase cycle: vouching, three-way matching, cut-off, duplicates and vendor balances.
The purchase order said it was raised before the goods arrived. The security gate's own entry log, and the transporter's delivery slip, both said otherwise.
The advance had sat under 'advances to suppliers' for a year and a half with no goods received against it. It only got properly looked at when the confirmation letter came back marked undelivered.
A duplicate vendor record isn't a data-quality curiosity — it's how duplicate payments and fictitious vendors both get past controls that check the invoice but never check the master.
A duplicate payment doesn't announce itself. Nothing in a normal accounts payable process is actually built to notice one.
The invoice had already been vouched once. It came back a second time under a different invoice number, same vendor, same amount, four days apart.
What to test when a client's GRNs do not exist or cannot be trusted, and how GRN-to-invoice timing is used as a cut-off indicator rather than a formality.
How to test whether purchases above a threshold actually went through the approval matrix, and the invoice-splitting pattern that is the most common way around it.
Which dates to compare, how terms of delivery decide the answer, how to size the window, and four worked examples including the two that are usually misjudged.
Why exact matching finds almost nothing, the six match rules that do work, and how to tell a duplicate booking from a duplicate payment.
What to examine on a purchase invoice, in what order, the tickmarks worth using, and how to record the test so a reviewer can tell what was checked without asking.
What a purchase register must contain, the checks that establish it is complete and internally consistent, and the defects that quietly invalidate everything tested on top of it.
Agreeing the population, choosing a sample basis that survives review, the procedures that address each assertion, and what to do with what they throw up.
How to select vendors for confirmation, the seven categories every difference falls into, how to handle non-responses, and what an unconfirmed balance is worth.
Every category of finding a three-way match can produce, what each usually means in an Indian mid-market client, and which are worth escalating versus documenting and moving on.
GST & GSTR-2B
Reconciling input tax credit to the purchase register, and investigating what does not agree.
A sales register total that matches the GSTR-1 total can still contain invoices with no IRN at all — the QR code check has to run invoice by invoice, not at the total level.
An audit checklist for e-invoicing compliance: applicability thresholds, IRN generation testing, and the common gaps between invoices raised and reported.
What a statutory auditor checks on e-way bill compliance: threshold applicability, validity tracking, and reconciliation against the sales and purchase registers.
GSTR-9C stopped needing a mandatory CA certification for most taxpayers from FY 2020-21 onward. That changed who signs it, not whether the statutory audit still needs to check the turnover reconciliation.
A composition dealer doesn't reconcile GSTR-2B the way a regular taxpayer does — the audit checks shift toward eligibility monitoring and the flat-rate computation instead.
GSTR-1 is meant to auto-populate from e-invoice data for in-scope taxpayers, which means any manual entry that bypasses that auto-population is itself worth investigating.
The manual version isn't free just because no invoice gets raised for it. It has a real, costable number attached — here it is, worked through.
How to reconcile GSTR-9 turnover and ITC figures against the audited financial statements, and explain the variances before filing.
A reverse charge liability that is correctly computed can still fail compliance if the self-invoice backing it was never actually issued, or was issued late — this is a check on the document, not the tax math.
An audit checklist for TDS compliance on contractor payments, professional fees, purchase of goods and benefits under sections 194C, 194J, 194Q and 194R.
A large share of textile output is never owned, start to finish, by a single unit. Tracking goods sent out and received back as job work, and the GST that rides on it, is the audit.
The GST portal calculates and collects the late fee and interest. The accounting system never sees either number unless someone goes and gets it.
A clean match between GSTR-2B and your books is the exception. Here's why mismatches are the norm, and which ones actually matter.
Thirty-one thousand rupees of claimed input credit had no matching entry in GSTR-2B. The client's answer was "it's probably a timing thing." It was, but that isn't a place to stop looking.
Why GSTR-1 and GSTR-3B outward-supply figures disagree, the usual causes, and what to do with a difference still unreconciled at the year end.
How to test that reverse-charge GST liability was actually paid in cash, not offset against ITC, and that the matching credit landed in the right period.
Running input credit reconciliation as a recurring service across many clients: the monthly cycle, what to standardise, how to staff it, and how to tell whether it is working.
What GSTR-2B is, how the Invoice Management System changed it, the statutory conditions that govern input credit, and how to run and conclude the reconciliation.
The two documents record different events on different bases. Which differences are structural and expected, how to match the files reliably, and how to work one down to a cause.
A decision path for an ITC mismatch: available, eligible, still claimable. What the client can do about each outcome, and how to quantify credit at risk.
Pooling registrations, reconciling against 2A, stopping at March, netting categories and eight more errors, with what each causes and how to correct it.
What GSTR-2B is, how it differs from 2A, and the six categories every reconciliation difference falls into — with what each one usually means and what it implies for the audit file.
Audit documentation
What has to be in the file: working papers, evidence, traceability and review.
Ind AS 101's whole balance sheet gets rebuilt on one date — and the exemptions chosen on that date determine the opening equity figure every later year is measured against.
Goodwill is a plug, not a valuation — it only means something if every identifiable asset and liability underneath it was measured correctly first.
Ind AS 104 permits existing accounting policies to continue, with one override that cannot be skipped — the liability adequacy test.
Ind AS 110's control test decides the consolidation perimeter before a single elimination entry is passed — get the perimeter wrong and nothing downstream is correct.
Ind AS 111's whole accounting outcome turns on one classification question — and that question is answered by the arrangement's rights and obligations, not by what it's called in the contract.
Ind AS 112 exists to answer one question for the reader that the consolidated numbers alone can't: where exactly is the risk sitting across the group structure.
Ind AS 114 only works for entities that qualify for it at all — and every balance recognised under it has to trace back to an actual regulator decision, not a management estimate of what the regulator will eventually allow.
Ind AS 117 is built around a measurement model choice made once, for a defined group of contracts, that the auditor has to confirm was the right choice before testing anything inside the model.
Ind AS 27 is a short standard with one real audit question: which of the three permitted bases did management elect for investments, and is it actually the basis that was applied.
The equity method under Ind AS 28 moves a single number every period — and that number is only as reliable as the investee's own financial statements feeding it.
Ind AS 29 doesn't adjust for inflation gradually — once an economy is judged hyperinflationary, the entire financial statements get restated into current purchasing power at the balance sheet date.
Ind AS 32 cares about substance over legal form for one specific question — does the issuer have an unconditional right to avoid delivering cash — and that single test decides liability vs equity.
A deferred tax working paper is only as reliable as the asset-by-asset tax base comparison underneath it — the effective rate reconciliation at the top is just the output of that comparison.
A click-to-accept e-sign and a Class 3 digital signature certificate prove very different things. Treating them as interchangeable is where the evidentiary value quietly disappears.
A purchase order at a fixed price is not onerous just because the market has moved. It is onerous only when the committed price exceeds what the entity can realise from what it buys.
The first question is whether the transfer is a sale at all under Ind AS 115. Everything about the gain recognised and the leaseback liability follows from that answer.
The same overdraft facility can be a cash equivalent in the cash flow statement and a borrowing on the balance sheet. Testing it means checking both treatments separately, against different rules.
Research spend is always expensed. Development spend is capitalised only if all six Ind AS 38 criteria are met, and the split between the two is where most of the testing effort belongs.
Classification errors in the cash flow statement almost always move cash into or out of operating activities, because that is the line readers care about most.
An earn-out is a liability measured at fair value on day one, almost always, and most of the audit work is in the remeasurement that follows, not the initial entry.
A covenant breach does not need to be disclosed as a breach to affect the audit. It needs to be traced through to classification and to going concern, whether or not the lender has waived it.
Trace every deferred tax asset to the temporary difference that created it, test the profit forecast behind recognition, and document the judgement rather than the arithmetic.
List every potential equity instrument outstanding, apply the right dilution method to each, and test the anti-dilution screen instrument by instrument.
A loan that moves stage without a documented trigger is the single most common finding in an ECL audit file for an NBFC or a non-bank lender.
Most embedded derivatives are missed at identification, not at valuation. Find the host-plus-feature structure first, then test whether separation is even required.
The subsidiary's own consolidated losses are not the impairment test. The parent's recoverable amount for its investment is, and that number has to be computed separately.
Test the contract against the Ind AS 116 definition of a lease first, then the recognition exemptions, before any right-of-use asset or liability is built.
Get the full legal case file independently of management's summary, test the probability and measurement judgement on each matter, and confirm it externally with counsel.
Identify contracts where unavoidable costs exceed the benefits expected, recompute the least net cost of exit, and check the prior year's provision against what actually happened.
Start from the internal management reports the chief operating decision maker actually uses, then work backwards to test whether the segment note matches them.
A slump sale has one number on the agreement — the lump-sum price — but two entirely separate sets of accounts and tax computations behind it, on the seller's side and the buyer's.
Recompute the translation of each foreign operation independently, test the rates used, and trace the recycling entry on disposal or loss of control.
Rebuild the claims-experience model from actual claim data rather than the client's rate, test the assumptions, and check the prior provision against what was actually claimed.
Ind AS and ICDS diverge on a known, repeatable set of items — unrealised forex gains, borrowing costs, and construction contracts among them. The reconciliation statement should be tested against that list, not read as a single number.
The ECL number on the balance sheet is a model output. The audit work is entirely about whether the stage allocation and the inputs feeding that model actually hold up.
The balance sheet total rarely stays the same between AS and Ind AS. If the opening Ind AS balance sheet doesn't show a reconciling adjustment anywhere, that's the finding, not the all-clear.
A grant isn't general-purpose income the moment it lands in the bank account. It's restricted to a purpose, a budget line, and often a timeline — and the audit has to test against all three.
SA 260 isn't the deficiency letter. It's the broader set of planning, findings and independence communications a board is entitled to before the report is signed.
Mentioning a control gap in the closing meeting is not the SA 265 communication. A significant deficiency has to go to those charged with governance in writing.
A misstatement that's immaterial on its own doesn't stay immaterial once it's added to the schedule. SA 450 requires the running total, not just the single-item test.
SA 500 isn't a list of acceptable evidence types. It's a reliability hierarchy and a sufficiency test the auditor has to apply to every item on the file.
SA 505's rules on non-responses and negative confirmations apply just as much to a lawyer's letter or a lender confirmation as they do to a bank or debtor one.
A qualified prior-year opinion doesn't just disappear from the file this year. SA 710 requires it to be referenced again if the matter is still unresolved.
SA 720 doesn't ask the auditor to audit the director's report. It asks them to read it and flag anything that contradicts the numbers they just signed off.
The confirmation came back signed, stamped, and matching the balance exactly. The person who signed it had stopped working there eight months earlier.
The deferred tax asset assumed the company would be profitable enough to use up three years of accumulated losses. When asked for the forecast behind that assumption, none existed.
The financial statements are the easy part. The harder part is whether income was actually applied to charitable objects, and whether the entity stayed within its own deed.
The file name is a confession. If a working paper needs 'actualfinal' in its name, the firm has no real way of knowing which version was reviewed.
A management representation letter signed back with a qualification isn't a smaller problem than an outright refusal. SA 580 treats doubt about reliability as a trigger on its own.
The doubt doesn't disappear because it isn't real. It disappears because management's mitigation plan was accepted without being tested on its own terms.
The letter gets drafted at the exact moment in the engagement when nobody has time left to check it against anything.
The standard says to report the business the way management actually looks at it internally. The note usually gets drafted from the org chart instead.
Legal can track a case perfectly and finance can still never hear about it — the two functions aren't connected by any process that moves the information across.
Most companies don't maintain a running book-vs-tax carrying value comparison. They rebuild it at year-end, and reconstruction is where the errors come from.
Diluted EPS isn't one calculation — it's a separate dilution test for every instrument, and skipping that per-instrument test is exactly how one gets missed.
The fastest way to draft a KAM is to start from a template. Genericity is exactly what survives that shortcut.
A provision tends to drift behind reality for a simple reason: it's built by adjusting last period's figure, not by re-estimating from scratch.
The exemption test looks at the lease term at commencement, not however much time happens to be left when someone checks. That distinction keeps getting collapsed.
The window the standard cares about runs to the signing date, not the drafting date. Most review procedures quietly stop short of it.
A trial balance and a general ledger that disagree usually weren't pulled at the same moment — not miscalculated.
Four statements plus notes isn't optional structure — Ind AS 1 defines exactly what counts as a complete set, and a financial statement missing one piece isn't compliant regardless of how good the other three look.
The accounting standard's adjusting/non-adjusting distinction is the same logic SA 560 uses on the audit side — this is where it actually comes from.
Segments aren't drawn by an accounting standard's own logic — they're drawn from how the business genuinely reports to the person who actually runs it.
Fair value isn't one method — it's a framework that ranks how reliable the inputs behind a number actually are, from an observable market price down to a pure internal estimate.
Deferred tax isn't computed from the profit and loss difference between book and tax. It's computed balance sheet item by balance sheet item, and that distinction changes the whole calculation.
A grant is income, recognised over the period it's meant to compensate for — not a windfall credited to reserves the day it's received.
The share count used in the EPS calculation is a weighted average across the year, not the number of shares outstanding on the last day — a detail that changes the result whenever shares were issued mid-year.
A quarter's results aren't simply the annual number divided by four. Ind AS 34 treats each interim period as its own reporting period, with its own measurement.
Three categories, three completely different treatments — recognise it, disclose it, or say nothing. Getting the category wrong is the whole misstatement.
The three-way split sounds obvious until a specific cash flow — interest paid, a short-term investment, a lease payment — doesn't obviously belong anywhere.
The same-looking number change gets a completely different accounting treatment depending on WHY it changed. Getting that classification wrong is its own error.
A signed representation letter is not evidence that something is true. It's evidence that management told you it was true — a different and much weaker thing.
The approval memo was dated the 28th. The file it came from was created on the 4th of the following month. Nobody had checked that before.
What an engagement letter must establish, when it needs renewing, and the gaps most often found on file inspection — undated letters and stale scope.
Logging outstanding requests with an owner and due date, escalating when documents don't arrive, and closing a query with evidence rather than just a tick.
A checklist organised by when the work happens: planning, fieldwork, each paper, completion and assembly, with the deadlines that govern the last two.
Sufficiency and appropriateness without the textbook circularity, a reliability hierarchy for Indian practice, and what has to be recorded for evidence to be traceable.
The edit log the Companies Act now requires in the client's software, and the record of what the audit team did to its own file. What each must show, and how to test the first.
The anatomy of a paper that stands on its own: objective, population, sample basis, procedure, results, exceptions, conclusion and sign-off, and what each must establish.
What a reviewer is responsible for, a defensible review order, writing points that get cleared properly, and why approval must lapse when the paper changes.
The experienced-auditor test explained in plain terms, what documentation has to demonstrate, when the file has to be assembled, and the gaps that most often draw comment on review.
Audit workflow & automation
How an engagement runs end to end, and which parts of it can be systematised without touching judgment.
The same company can produce a materiality figure several times larger or smaller depending only on which benchmark is chosen — before the percentage is even applied.
Sample size barely moves with population size once a population gets reasonably large — it moves with tolerable error, expected error and confidence instead.
Thirty days to set up, thirty to pilot on one or two clients, thirty to expand with lessons already applied — not a single big-bang switch in week one.
Advance tax is tested instalment by instalment against the date it was actually estimated, not by checking the year-end total against the final tax liability.
The departing senior doesn't take a skill the firm can rehire for. They take the specific knowledge of why last year's unusual transaction wasn't actually a problem.
Past roughly 50 audit staff the decision stops being about one partner's workflow and starts being about standardising dozens of them at once.
Independence under the Code of Ethics doesn't stop at your own firm's letterhead. A network firm's relationship with a client can taint your own independence on a different engagement.
No Companies Act, no CARO, but a different statutory framework entirely — member funds, statutory reserves, and loan classification specific to co-operatives.
The question isn't just what to move over — it's what to deliberately re-create instead of migrating, and how to document the switch itself.
A foreign remittance that cleared the bank is not the same as a FEMA-compliant transaction — the filing obligation sits on the company, and the audit needs to check it separately.
Not every foreign remittance needs a 15CB, but every remittance that does needs the certified amount to actually match what the bank sent out — that match is the part audits skip.
A peer review doesn't re-audit the client. It checks whether the firm's own system — documentation, quality control, independence — would have caught a problem if there was one.
The MAT computation itself is one check. Whether the resulting credit is still available to carry forward, and whether it should be recognized on the balance sheet, is a separate and frequently skipped one.
A managing partner, an audit partner, and a quality-control partner are evaluating three different things when they look at the same software. Here's what each one actually cares about.
NFRA jurisdiction isn't about the auditor's firm size. It's about the company's own size and listing status, and it pulls the auditor's subsidiaries and associates in with it.
The right rollout speed depends on how similar the firm's engagements actually are to each other, not on how confident the partner feels after the demo.
"We've always done it this way and it's worked fine" is the objection underneath most of the others. Here's how to actually meet it, not just talk past it.
On-site fieldwork gives a senior constant informal visibility into what juniors are actually doing. Remote work removes that by default, and most firms haven't replaced it with anything.
Signing last year's engagement letter forward without re-reading it misses exactly what SA 210 requires you to check again each year.
SQC 1 builds the firm's quality system. SA 220 is what the engagement partner has to personally do with it on this specific file, this specific year.
Joint auditors aren't each liable for the whole audit, but they aren't each liable only for their own slice either. SA 299 draws that line precisely, and it's not where most people assume.
Trusting last year's closing balance because a predecessor signed off on it isn't evidence under SA 510. The new auditor still has to get comfortable independently.
SA 530 doesn't mandate statistical sampling. What it mandates is that every sample, statistical or not, has to let you project results to the whole population.
A tax-basis balance sheet prepared for a lender covenant isn't a smaller version of a general purpose audit. SA 800 requires the report to say so, explicitly, every time it's used.
Auditing just the receivables schedule for a lender isn't a smaller version of the full audit. SA 805 requires materiality to be set against that element, not the whole balance sheet.
A summary financial statement needs its own opinion, derived from, but not identical to, the opinion on the audited full set it was taken from. SA 810 sets out exactly how.
SA 220 tells a partner what to do on one file. SQC 1 is what the firm has to have in place before that partner can do it consistently across every file.
A review isn't a lighter audit using the same procedures done faster. SRE 2400 is a different procedure set entirely, built around inquiry and analytics, not verification.
The compensation committee shortened the vesting period by a year. Finance kept expensing the options on the original schedule for the next twelve months, because nobody told them it had changed.
Excel doesn't send an invoice, so the cost looks like zero. The real cost shows up two or three years in, in ways that are easy to miss until they happen.
The warranty provision had used the same 1.5% of sales rate for three straight years. One of those years included a product recall that cost four times the provision in actual claims.
A UDIN generated after the document has already gone out to the bank or ROC is the single most common compliance failure ICAI catches, not fraud — just a missed deadline.
What to check before financials are tagged in XBRL for MCA filing: applicability, taxonomy mapping accuracy, and tie-out against the signed statements.
SA 200 is where "reasonable assurance, not absolute assurance" and the inherent limitations of an audit actually come from — not a footnote, the foundation.
The auditor is not a compliance officer. SA 250 draws a specific line around what they're actually responsible for noticing.
The strategy answers "what kind of audit is this." The plan answers "who does what, when." SA 300 keeps them as two different documents on purpose.
A risk assessment that doesn't name a specific assertion isn't a risk assessment under SA 315 — it's a general impression written down.
Overall materiality and performance materiality are not the same number with a safety margin added — they answer two different questions.
A higher-risk item doesn't just need more testing. It needs more persuasive evidence — those are two different design decisions.
An estimate can't be vouched to a source document the way an invoice can. SA 540 is about what replaces vouching when there's no single right answer to check against.
The auditor's responsibility for subsequent events doesn't end on one fixed date. It changes shape across three separate windows, each with a different obligation.
Most going-concern evaluations end exactly where they should: no material uncertainty, no change to the report. The standard is about the minority of cases where that's not true.
Using another firm's work on a subsidiary doesn't transfer responsibility for the group opinion. SA 600 is explicit about what stays with the group auditor regardless.
A qualified expert's signature on a report is not, by itself, sufficient audit evidence. SA 620 is about what the auditor still has to do with that report.
Finishing every planned procedure isn't the same as forming an opinion. SA 700 is the step that happens after the checklist, not instead of it.
A key audit matter is drawn from what was already communicated to those charged with governance — it's a filter on that list, not a separate exercise.
Two questions decide which modification applies, and they're genuinely independent of each other — getting one right doesn't tell you the other.
Both paragraphs sit inside an unmodified opinion. The difference is what they're pointing at — something already in the financial statements, or something outside them.
Statistical vs judgmental sampling, when full-population testing removes the need to sample, when sampling still applies, and what drives sample size.
Understanding the entity, setting materiality, risk assessment at planning, and briefing the team against a realistic timeline — a rounded planning reference.
The three tasks language models genuinely do well in audit, the three they must never be given, and the questions to ask a vendor before any client data moves.
How to decide what to automate, ranked by return rather than by how impressive it sounds, with a scored ranking of common audit tasks and what to leave alone.
Where the boundary between mechanical work and judgment falls, a test for deciding which side a task is on, and how to keep the boundary from eroding.
What to test before buying: Indian data and calendar, evidence traceability, review and sign-off, data handling, and the questions vendors find hardest.
Requesting documents so they arrive usable, classifying what comes in, keeping versions straight, and always knowing what is still outstanding.
An engagement end to end: acceptance through to sign-off, with where the time actually goes and the four points at which engagements reliably stall.
Audit data & extracts
Getting a population out of the client's accounting system in a state you can test.
A written data retention policy is a document. Whether a specific record from three years ago can actually be pulled up today, in a readable form, is a different fact the audit needs to check separately.
Testing every transaction instead of a sample doesn't just change audit quality — it changes where the firm's hours go and what the engagement fee conversation looks like.
Merged ledger names, inconsistent voucher types, negative values from contra entries: the mess that Tally exports arrive in, and a checklist to clean it before any testing starts.
Separate company files per branch, inter-branch transfers that need eliminating, and vendors shared across branches that look like duplicates. Consolidating multi-branch data before testing starts.
Busy, Zoho Books and Marg each export audit data differently from Tally, and each has a specific weak point an auditor needs to plan around.
Date, voucher type, narration, debit, credit, running balance: what a general ledger extract needs, and why a day-book export and a ledger-wise export are not interchangeable.
Pen-drive discipline, who can open the shared drive, and what happens to the client's data after sign-off: the practical hygiene that protects a firm handling someone else's accounting records.
Suspense ledgers with material balances, similar expenses grouped three different ways: the structural problems in a chart of accounts that are far cheaper to fix before year-end close than after.
Mapping a client's idiosyncratic ledgers to a standard chart of accounts is the step that decides whether analytics and disclosures work at all, and the one most firms rush.
A sample drawn from an unvalidated population tells you something precise about the wrong set of transactions. The checks that establish a population is actually a population, before any sampling begins.
The export paths that actually work, what each one loses, and how to handle the three problems that break most audit imports: blank ledger names, duplicated vendor masters, and opening balances that do not tie.
Revenue, receivables & cut-off
Testing revenue recognition, debtors and the cut-off either side of the year end.
Ind AS 115 doesn't ask when revenue is earned — it asks when control of a distinct good or service transfers, and each of the five steps changes that answer.
Retention held back for years, work-in-progress built on a cost-to-complete forecast, and claims revenue nobody has actually agreed to pay — the three places a construction audit actually earns its fee.
A marketplace doesn't carry the inventory, so the audit moves to where the real exposure is: whether revenue is gross or net, COD settlement reconciliation, and the returns provision.
The academic year and the financial year don't align, fee waivers can be understated as revenue instead of a deduction, and grant money has strings a normal receipt doesn't.
A hospital's debtors ledger isn't one population. Cash patients, TPA claims and government-scheme reimbursements each need their own recoverability test.
A guest checking out after midnight on 31 March, F&B stock nobody reconciles against consumption, and loyalty points that are a real liability most hotels under-provide for.
The indicators list in Ind AS 115 is a checklist of evidence, not the test itself. The test is control over the good or service before it transfers to the customer.
A sale with a right of return is really three balances at once: the revenue actually earned, a refund liability, and an asset for the goods expected back. Testing one without the other two is incomplete.
A contract asset and a contract liability on the same customer are not a netting opportunity. They have to be presented separately unless the contracts genuinely create a single net position.
The IRN timestamp is generated outside the client's own books, by the government portal, at the moment the invoice was reported. That makes it unusually hard to backdate.
Variable consideration is estimated using one of two specified methods and then constrained. Skipping the constraint step is the most common way this estimate ends up too high.
Commission rates aren't whatever the intermediary and insurer agree to. IRDAI caps them by product, and the audit has to check the structure against those caps, not just recompute the commission earned.
Trail commission isn't a flat fee. It moves with AUM every single day, and recognising it correctly means building an accrual that tracks that movement, not booking the AMC's monthly payout as the year's income.
Most residential developers moved from recognising revenue as construction progressed to recognising it at possession. Auditing whether that call was actually right is the core of this engagement.
The invoice amount and the revenue amount are rarely the same number in a SaaS contract. The gap between them is deferred revenue, and getting it wrong is the whole audit.
The invoice was dated the last day of the financial year. The e-way bill tied to the same consignment was generated four days later — meaning the goods could not have left the warehouse when the sale was booked.
Most unanswered confirmation requests mean the customer's accounts team didn't prioritize a form, not that the balance is wrong.
The cash and the income rarely belong in the same period. Treating receipt as the recognition trigger is how the two get confused.
The old model waited for a loss to be incurred before providing for it. ECL is built the opposite way — provide for the loss you expect, before it happens.
Invoiced on the 31st. Dispatched on the 3rd. The sale was real. The year it belonged to was not the one the client had booked it in.
The expected credit loss model at a practical level, how it compares to ageing-based provisioning, testing management's assumptions, and the write-off authorisation trail.
Why post-year-end credit notes are a classic overstatement signal, how to match them to the original invoice, and the GST reporting implications auditors should check.
A reference catalogue of the exceptions that recur most often across revenue and receivables testing, why each happens, and what to do about it.
Positive versus negative confirmation, selection criteria, handling non-responses and disputes, and the alternative procedures that cover the gap when confirmations fail.
The documents unique to export sales, how to test realisation of export proceeds, and how the GST refund process interacts with export audit work.
The sales-side mirror of the purchase three-way match: what breaks it in practice, and why the unmatched population should be sized by value, not count.
The transfer-of-control test that governs when a sale is recognised, the misstatement patterns that recur in practice, and what evidence ties a recognised sale to an underlying document.
Why dispatch, invoice and ledger dates disagree at year end, how to sample either side of the cut-off, and the evidence that settles which date governs.
Identifying related-party customers from the sales register, assessing pricing against arm's-length comparables at a practical level, and the audit approach that ties it together.
Bank, cash & treasury
Bank reconciliation, cash verification and treasury controls testing.
Every chit has a running liability to subscribers who haven't yet won their draw. Reconciling that liability, instalment by instalment, chit by chit, is most of this audit.
The single question a broker audit exists to answer: is client money actually separate from the broker's own money, every single day, or is it being used to fund the broker's own trading.
The commission was a small, recurring line — easy to miss. It kept being paid on a bank guarantee securing a contract that had already closed out eight months earlier.
The branch's cash book had never shown a shortage in three years of scheduled counts. The one surprise count that caught a shortfall happened to land on a week the branch manager was on leave.
The fixed deposit schedule showed ₹40 lakh sitting free and clear. The bank confirmation letter, in its standard boilerplate paragraph, mentioned a lien marked against that exact deposit.
A bank guarantee usually never touches the accounting system at all until it's called — which is also why it never shows up on the disclosure list.
The gap usually isn't a calculation error. It's three different exchange rates, each individually correct, applied inconsistently to the same balance.
A difference between your books and the bank is the expected state, not the exception. The question is always which specific items explain it.
Monetary items get retranslated every reporting date. Non-monetary items, carried at historical cost, generally don't. The distinction decides almost everything else.
The bank's confirmation letter listed a guarantee outstanding. The client's draft notes to accounts didn't mention it at all.
The cash on hand was short by just under four thousand rupees against the book balance. The explanation took longer to find than the shortfall took to count.
Restating EEFC and other foreign currency balances at year end, testing the exchange gain or loss, and the documentation worth sighting.
What a bank confirmation covers beyond the balance, how to keep the request genuinely independent, and what to do when the bank is late.
Why BGs are off-balance-sheet contingent liabilities, confirming with the bank, tracking expiry, and verifying the margin money behind each one.
What a BRS must reconcile, the red flags that separate a timing difference from a cover-up, and how many months you actually need to review.
How to run a surprise cash count with proper dual control, what to do with IOUs found in the box, and how much effort a small cash balance really deserves.
Verifying FD receipts, checking for liens against loans and guarantees, getting the current/non-current split right, and testing accrued interest.
Sanction letter checks, charge verification against ROC filings, covenant compliance, interest testing, and current/non-current classification.
The imprest system, voucher-level testing, the split-purchase trick used to dodge approval limits, and reconciliation frequency.
Segregation of duties over payments, dual signatories, bank mandate review frequency, and whether cash flow forecasting is real or decorative.
Fixed assets & capex
Verifying additions, disposals, depreciation and the physical existence of fixed assets.
Ind AS 106 doesn't prescribe a single accounting policy for exploration costs — it requires the entity's own chosen policy to be applied consistently, which is exactly what the audit has to pin down first.
Ind AS 36 impairment lives or dies on one question answered first: what is the cash-generating unit. Get that wrong and the recoverable amount calculation that follows is irrelevant.
Using a different useful life than Schedule II isn't the compliance gap. Not disclosing why is.
Identify genuinely qualifying assets, recompute the capitalisation rate from the actual borrowing mix, and test suspension during construction interruptions.
Confirm the CGU allocation goes back to the acquisition itself, test the recoverable amount model built for each unit, and check the impairment loss was allocated in the right sequence.
Confirm reasonable assurance of compliance before recognition, match the income release to the related cost or asset life, and test repayment contingencies separately.
Check the internal and external indicators first, then decide whether a full recoverable-amount test is unavoidable — and document the conclusion either way.
Assess the valuer, test the valuation inputs against observable market data, and check the fair value note against what Ind AS 40 actually requires it to say.
Distinguish a genuine modification from a remeasurement trigger, recompute the revised lease liability with the current discount rate, and test the right-of-use adjustment that follows.
Identify every identifiable intangible asset the acquirer may have missed, test the valuation methods, and recompute goodwill as the residual rather than a figure decided in advance.
Classifying an asset as held for sale is a management assertion. This is the evidence trail that turns it into something an auditor can actually sign off on.
A rent renegotiation isn't one journal entry under Ind AS 116 — it's a classification decision first, and the lease liability recomputation only happens after that decision is right.
A truck isn't one asset for depreciation purposes, and a journey that starts in March and ends in April isn't revenue in either month cleanly. That's most of the audit.
Most pharma R&D spend should be expensed, not capitalised, because the Ind AS 38 recognition criteria aren't met until regulatory approval is near-certain. Testing that project by project is the audit.
The fixed asset register's depreciation subtotal was off from the trial balance by a precise, non-rounding amount. The gap turned out to be a useful-life change applied from October, never disclosed anywhere.
The verification sheet showed three machines present and in good condition. The scrap dealer's gate pass showed those exact tag numbers had left the premises four months earlier.
Nobody decides to let a fixed asset register go stale. It happens through a hundred small, individually reasonable omissions.
The stop date is "substantially ready for use," not "fully finished" and not "loan repaid" — and that specific moment is exactly where judgment drifts.
Nobody usually assesses the useful life of an intangible asset separately — a default period gets entered once, and the error compounds for years.
The cost model lets you carry the property at cost. It does not let you skip disclosing what the fair value actually is.
A management decision to sell isn't enough. The asset has to be genuinely available right now, and the sale has to be highly probable within twelve months — a specific, checkable bar.
A single asset with parts that wear out on different schedules isn't one depreciation calculation — Ind AS 16 requires splitting it, and a lot of fixed asset registers still don't.
Not every loan funding construction gets its interest capitalised automatically — the asset has to qualify, and capitalisation has to actually stop at a specific point.
Research is always expensed. Development can be capitalised, but only once six specific conditions are all met — a much stricter bar than it sounds.
The same physical building can be investment property or ordinary PPE depending entirely on why the company holds it — the classification question is purpose, not bricks.
The capitalisation criteria, the repairs-versus-improvement judgement calls that actually come up, and how to sample repairs and maintenance for misclassified capex.
Ageing stalled CWIP, testing the capitalisation trigger, applying Ind AS 23 in practice, and the ageing schedule now required in the financial statements.
Checking useful lives against Schedule II, recomputing the charge independently for a sample, and handling mid-year additions, disposals and changes in estimate.
The authorisation trail for a disposal, testing the gain-or-loss computation, cleaning up the register and insurance, and GST on the sale of used assets.
What a fixed asset register must contain, how to tie it to the general ledger, and the gaps that quietly survive year after year if nobody checks for them.
The impairment indicators that actually matter for a mid-market client, when a formal test is genuinely warranted, and how to test management's recoverable amount workings.
How the right-of-use asset and lease liability are recognised, testing the discount rate and lease term, the exemptions that still exist, and the errors that recur most often.
A rotational verification policy, reconciling the count to the register, handling assets at customer or third-party sites, and the link to CARO 3(i).
Inventory & stock
Stock count observation, valuation and cut-off for inventory.
A standing crop or a herd of livestock isn't carried at what was spent on it. It's carried at fair value less costs to sell, and the audit has to test that valuation directly.
Ind AS 2 is a two-number test applied line by line: cost, and NRV, with the lower one winning. Most errors hide in what gets loaded into 'cost'.
Ind AS 41 measures living assets at fair value by default, not cost — which means the audit evidence standard is a market price, not a management estimate.
A trading company's inventory is what it bought. A manufacturer's inventory is what it bought, partly converted, with scrap and process loss along the way — and that's the audit.
A chain with forty stores doesn't have one inventory risk, it has forty, each with its own count, its own POS-to-ledger reconciliation, and its own shrinkage pattern.
A ₹35 lakh inventory write-down was booked at year end for slow-moving stock. Three months later the same stock was written back up, with no sale, no new order, and no explanation on file.
Each individual variance is small enough to adjust and move on from. That's precisely why the pattern behind it never gets looked at.
SA 501 exists because two specific kinds of evidence don't behave like ordinary evidence: a physical count that happens once a year, and a legal exposure management has every incentive to understate.
A product line discontinued eighteen months earlier was still carried at full cost. Nobody had looked at it since the last unit sold.
The physical count came in 6% below the system quantity for one product line. Six percent is too large to be counting error.
Ageing analysis by SKU, testing the provisioning policy against actual realization, and red flags where a policy is never applied in practice.
Material, labour and overhead variance analysis under standard costing, and what each variance tells an auditor about inventory valuation risk.
Distinguishing consignment-in from owned stock and the reverse, who recognizes it, GST implications at a high level, and common misclassification.
Goods-in-transit at year end, last GRN and dispatch numbers before and after cut-off, and matching to the stock count and purchase/sales cut-off testing.
Testing the cost formula actually applied against the one disclosed, NRV testing, and overhead absorption into manufacturing cost.
Distinguishing genuine shrinkage from a data or counting error, materiality thresholds for investigation, and write-off authorization.
Planning the count date and cut-off instructions, test counts and sampling, covering multiple locations at once, and reconciling count to book quantities.
Alternative procedures when physical attendance isn't practical: confirmation, reviewing the warehouse operator's own reports, and job-work challan risks.
Stage-of-completion estimation challenges, testing the bill of materials and standard cost build-up, and the physical verification difficulty of WIP.
Payroll & employee cost
Testing payroll, statutory dues and employee benefit obligations.
Ind AS 102 spreads a single grant-date fair value across the vesting period — but whether a forfeiture changes that expense depends entirely on which type of condition caused it.
The number comes from an actuary, but the auditor still owns the opinion on it — that means testing the data going in, not just reading the report coming out.
A ghost employee isn't a sophisticated fraud. It's an ordinary process with no second person checking it.
Two actuaries can run the same valuation model on the same employee data and land on materially different liabilities, purely from the discount rate and attrition assumptions fed in.
Running an exempted PF trust means the employer, not EPFO, guarantees the statutory interest rate. The audit has to test whether the trust's own investments can actually deliver it.
Trace every grant to its vesting schedule, recompute the fair-value charge period by period, and test forfeitures separately from the base charge.
Classify each vesting condition correctly, test how re-estimation differs between the three categories, and trace any modification to the condition that actually changed.
Shops and Establishments registration lapses quietly because renewal is annual and easy to miss — here is what the audit should check beyond the certificate on file.
Professional tax is a state subject with different slabs, due dates and registration rules in each state — here is how to test it without assuming one state's rule applies everywhere.
The ESOP charge should be based on fair value at the grant date. Auditing a startup's ESOP expense usually means first finding out whether that valuation exists at all.
A TDS liability that nets to the right figure in the books can still hide a wrong-rate deduction on one vendor and a missed deduction on another — the reconciliation needs to run at the transaction level.
The same person submitted an identical professional-fee invoice every month for two years, worked fixed hours at the client's office, and reported to a manager like everyone else on the floor.
A short TDS deduction is usually a classification decision made once, at booking, and never checked again.
One employee ID had drawn a full salary for eleven months with no biometric attendance record at all. The HR file for that ID was thin in a specific way.
The actuary had valued the obligation correctly. The data file feeding the actuary had the wrong number in it for every employee.
Payment of Bonus Act basics, provision-versus-actual testing, approval evidence for discretionary schemes, and accrual cut-off — the audit approach to bonus and incentive payments.
Actuarial valuation basics, when a simplified approach can substitute for it, and how to test the leave balance data that feeds the encashment provision.
Why misclassification creates PF, ESI, and TDS exposure, the indicators to look for, and how GST on contractor invoices differs from salary.
Managerial remuneration limits and approvals, financial statement disclosure, and testing payments against board and shareholder resolutions.
Master data testing, gross-to-net recomputation, statutory deduction checks, and the approval trail — the full payroll audit procedure in order.
Ghost employees, duplicate bank accounts, unauthorized master changes before a payroll run, and the analytical procedures that surface them.
Applicability, challan matching, due-date testing, and the employer-versus-employee contribution reconciliation — the PF and ESI compliance checks a payroll audit needs.
Recomputing TDS for a sample against the declared regime, matching to Form 24Q, and reconciling TDS deducted to deposited and to the payroll register.
CARO & Companies Act
CARO 2020 reporting clauses and Companies Act compliance testing.
What an auditor checks when reviewing advance tax provisioning: estimated income basis, instalment timing, and interest exposure under sections 234B and 234C.
How to test whether title deeds of immovable property are held in the company's own name, build the exceptions schedule, and treat leasehold differently from owned property.
How to test a revaluation of PPE for CARO clause 3(i)(d): checking the registered valuer, the revaluation policy, and the 10% aggregate variance threshold.
How to test for benami property proceedings under CARO clause 3(i)(e), including inquiry procedures when management reports nothing to disclose.
How to test loans, investments, guarantees and security given by a company against sections 185 and 186 for CARO clause 3(iv) reporting.
A walkthrough of each of the six sub-parts of CARO clause 3(ix), from default in repayment to fund diversion to subsidiaries, with what the auditor tests for each.
How to trace IPO or FPO proceeds from the offer document's stated use to actual deployment, for CARO clause 3(x)(a) reporting.
What the statutory auditor must specifically report under CARO clause 3(xiv) on the existence, adequacy and coverage of the company's internal audit system.
How to test whether unspent CSR amounts were correctly transferred to a specified fund or the unspent CSR account, for CARO clause 3(xx) reporting.
How to determine cost record and cost audit applicability under the Companies (Cost Records and Audit) Rules, and what the statutory auditor cross-checks.
You are not evaluating pollution control technology. You are checking whether a lapsed consent-to-operate or a pending notice has been evaluated for disclosure.
A practical walkthrough of the most audit-relevant Form 3CD clauses: disallowances, TDS, inventory valuation, loans and GST reconciliation.
What an auditor checks before Form CSR-2 is filed with the MCA: its relationship to the board's report CSR annexure and figures it must reconcile against.
What an auditor checks before Form DPT-3 is filed: deposit classification, exempted categories, and reconciliation against loan and advance ledgers.
Recompute the quantum limit and the debt-equity ratio test independently, test the solvency declaration, and check the cooling-off period before any further buyback or fresh issue.
Confirm each activity genuinely falls within Schedule VII, exclude anything that is really business expenditure in disguise, and recompute the mandated spend and the unspent transfer.
Recompute effective capital independently, apply the correct Schedule V limit tier to it, and test any excess remuneration against the waiver and recovery conditions.
Identify which payments actually needed central government or shareholder approval, trace that approval to its terms and timing, and test recovery where approval was missing.
Recompute the premium adjustment on buyback, test the capital redemption reserve transfer, and trace the extinguished shares out of the capital base and the reserves.
How ICDS diverges from Ind AS and Indian GAAP, and what an auditor checks when reconciling book profit to taxable income for ICDS reporting.
What an auditor checks on MAT computation under section 115JB: book profit adjustments, MAT credit tracking, and the normal tax comparison.
Where secretarial audit under section 204 and statutory audit overlap, where they diverge, and which compliance areas each actually tests.
The full section 135 CSR compliance picture: applicability, the two percent spending obligation, committee requirements, and unspent amount transfer.
A walkthrough of the matters an auditor must report under section 143(3), including accounting records adequacy, internal financial controls, and fraud reporting under 143(12).
The payment was booked against the CSR expenditure head and reported against the 2% requirement. The activity it actually funded — a sponsorship of a corporate sports event — fell outside every category in Schedule VII.
The 45-day rule sounds like one date comparison. In an actual purchase register it's three separate things that all have to line up before a delay is even real.
The GST liability crossed six months overdue four days before the balance sheet date. It was cleared two days after. The ageing test caught it anyway.
A company either clears the CARO exemption threshold or it doesn't — but clearing it isn't the end of the applicability question, it's the start.
The six-month line gets checked once a year, at close. It gets crossed, if it's going to be crossed, on an ordinary Tuesday in between.
A single discrepancy under 10% doesn't trigger the clause. The test is the AGGREGATE discrepancy for a class of inventory — a different, often-missed calculation.
Most companies this clause touches never get to the substantive question, because they aren't covered by the Cost Records Rules at all. Confirming that is the actual first step.
Declaring unrecorded income to the tax department and recording it in the books are two separate steps. The clause checks whether the second one actually happened.
SA 240 is about how the audit is performed. This clause is about what gets specifically disclosed once a fraud is actually found — a reporting requirement, not a detection procedure.
This clause applies to exactly one type of company. For everyone else, the correct response is "not applicable," reached by actually confirming the company isn't a Nidhi, not by skipping the question.
Two separate Companies Act provisions, both checked by one clause — approval through the audit committee, and approval under Section 188's own separate threshold.
This clause looks only one year ahead, using financial ratios and ageing as its stated basis. SA 570's going-concern window is longer, and its basis is broader.
The clause is named "non-cash" specifically because an ordinary cash payment to a director is covered elsewhere — this clause exists for the arrangements that aren't a simple cash transaction at all.
A company can be conducting NBFC-type business in substance — significant lending or investment activity — without ever formally describing itself that way, and still trip this clause.
A cash loss and an accounting loss aren't the same figure. The clause is specifically about one of them, measured across two consecutive years.
This clause only applies in one specific situation: a change in auditor during the year, with the new auditor required to report on what they did with the old auditor's concerns.
The group auditor doesn't re-audit each subsidiary's CARO clauses. This clause asks whether any component's own report had a qualification worth flagging at group level.
The register had a location column. Nobody had updated it in three years, across two office moves and a warehouse relocation.
The loan was in the financial statement notes, correctly disclosed. The CARO checklist for the loans clause had been filled in by someone who never cross-checked the notes.
What proper books of account require under the Companies Act, the audit-trail-software requirement, and how to test whether it is actually switched on.
The topic areas CARO reporting covers, what evidence each one needs, and how the clauses fit together across the audit file.
Testing loans, advances and investments given by the company for CARO reporting, including the overdue-loan-renewal pattern the clause is designed to surface.
Testing repayment schedules against actual payment dates, using bank confirmations as the independent check, and where the line sits between a minor delay and a reportable default.
What the fixed asset and inventory points under CARO actually require in evidence: physical verification, title deeds, revaluation, and count discrepancies.
How to test timely deposit of statutory dues for CARO reporting, handle disputed dues disclosure, and avoid redoing work already done in the GST and payroll sections.
The auditor's reporting responsibility on fraud noticed and whistle-blower complaints received, and how to document the enquiry behind it.
Identifying MSME vendors, testing 45-day payment tracking and interest disclosure, and why the vendor master needs Udyam enrichment before this test is even possible.
Board meeting frequency, statutory registers and ROC filing timeliness, read as evidence of compliance culture rather than a secretarial checklist in its own right.
Internal audit & IFC
Internal financial controls testing and internal audit procedures.
A change ticket with an approval signature doesn't tell you whether the change was actually tested before it hit the live financial system — those are two separate controls, tested separately.
A statutory auditor doesn't investigate POSH complaints, but the Internal Committee's existence and the directors' report disclosure are both checkable facts the audit should confirm.
Outsourcing payroll to a third party doesn't outsource the audit risk. SA 402 requires the auditor to still get comfortable with controls the client doesn't directly operate.
An org chart that shows separate roles for procurement and payment approval doesn't tell you whether the ERP's access rights actually enforce that separation — that is a system-level test, not a document review.
The same login that could add a new bank account to a vendor record could also approve the payment run that sent money to it. No transaction sample would ever have shown that.
The whistleblower register for the year showed zero complaints. An exiting employee's HR interview mentioned raising one, eight months earlier, that nobody else seemed to know about.
A signed-off access review spreadsheet is evidence someone looked at a list. Whether access was actually removed as a result is a separate fact the audit has to test.
Internal audit reports to the audit committee on its own calendar. Nothing in that calendar guarantees the statutory auditor ever sees the output.
The complaint mechanism was built to route a complaint to the audit committee. Nothing in that design routes it onward to the statutory auditor.
SA 240 doesn't make the auditor a fraud investigator. It requires planning and performing the audit as if fraud could exist, and documenting that you did.
SA 610 asks two separate questions, in a specific order. Skipping to the second without answering the first is the standard's most common misapplication.
How to structure an RCM so it actually drives testing, map it to financial statement assertions, and stop it from becoming the document nobody updates after the first year.
What a control walkthrough has to establish beyond description, narrative versus flowchart formats, and the shortfalls that recur most often on file inspection.
The fraud triangle applied practically rather than as theory, why management override is a presumed risk on every engagement, and what journal entry testing is actually looking for.
How IFC testing differs from a substantive statutory audit, what design versus operating effectiveness testing actually means in practice, and what the file needs to show for each.
How to scope a new internal audit mandate: the risk-based plan, coverage across the year rather than one visit, typical areas covered, and the reporting rhythm an audit committee expects.
Where internal audit and statutory audit genuinely differ — objective, reporting line, independence, and timing — and where coordinating the two saves real work on both sides.
What a whistleblower mechanism review has to check beyond the policy existing on paper, how to test whether complaints were actually investigated and closed, and how it connects to the auditor's fraud-reporting conversation.
The classic SoD conflicts, how to test for them in a small finance team where perfect separation is not realistic, and how to document the compensating controls that stand in.
What a SOC 1 Type II report actually tells the auditor when a client outsources a process, how to test the complementary user entity controls it assumes, and what to do when none exists.
Technology, data & AI in audit
How technology and AI actually fit into an audit, and where they don't.
The phrase covers everything from a genuinely useful document-extraction model to a marketing label on a feature that didn't need AI in the first place.
Three demos on three different days leave a firm with three separate impressions, not a comparison. A shared scoring sheet fixes that.
A hallucinated figure in a working paper reads exactly like a correct one. The only defence is knowing where a model could have touched the file and checking that spot deliberately.
Tally doesn't expose a modern REST API the way Zoho does — any tool claiming a seamless Tally integration is almost always working through an export or an XML request, not a live connection.
The honest answer depends on one number: how many hours of repetitive matching the firm actually does in a season, not how many staff it has.
The questions a firm's own IT or compliance reviewer raises before sign-off, listed so they can be answered before the vendor call, not during it.
A backup job that runs every night and reports success is not evidence the data can actually be restored — that only comes from a tested restore, which is the check most audits skip.
A blockchain changes audit evidence only when it is actually the system of record the auditor can read directly. Most client systems that mention blockchain don't meet that bar.
The Excel macro a firm built five years ago still runs, but nobody who understands it still works there. That's the real cost of building, and it rarely shows up in the build-vs-buy decision.
A portal link emailed without an expiry, sitting in someone's inbox for years, is a bigger exposure than most firms' entire password policy.
On-premise doesn't mean more secure, and cloud doesn't mean less control. The real tradeoff is who is responsible for backups, patching, and uptime, and whether the firm actually has the capacity to be that party.
Rule-based matching, anomaly detection, and AI classification aren't competing options for the same job — each one is the right tool for a different kind of exception.
Continuous auditing is not a software feature you turn on. It's an operational commitment to review exceptions every week, not once a year — and most firms haven't actually made that commitment.
A cyber insurance certificate on file tells you coverage was purchased. Whether that coverage actually responds to the incident the entity just had is a separate question the policy's exclusions answer, not the certificate.
A CA firm's client folder is a more concentrated target than any single client's own systems — one firm holds financial data for dozens of companies in one place.
"It's coming in the next release" has been true and false in equal measure across this industry. Here's how to tell which one you're hearing.
A 99.9% uptime number means little if the outage happens on March 30th. Here's the SLA language that actually matters when it's tested.
At 10-30 staff, the real ROI isn't hours saved on one file — it's whether a partner can review five engagements at once without five different working styles slowing every one of them down.
Same firm, same software, two pricing models — and the total cost can differ by a wide margin depending entirely on how many juniors touch each engagement.
A document a firm can send to three vendors at once and get back answers that are actually comparable, not three different sales decks.
RPA is good at clicking through the same screen the same way a thousand times. It is bad at the one time in those thousand that something looks slightly different.
Both get called 'smart matching' in a demo. One produces the same answer every time on the same data. The other doesn't, and that difference matters for an audit conclusion.
Nobody plans to introduce a spreadsheet error. It happens through one inserted row, one copy-paste over a formula, one hidden row nobody remembered was hidden.
The worst time to switch audit software is the time most firms actually do it: mid-cycle, under pressure, because the old tool just failed at the worst possible moment.
A bad implementation rarely looks like a bad product. It looks like a good product rolled out with no owner, no pilot, and no realistic sense of how long people actually take to learn it.
The subscription fee is the cheapest line on the invoice most firms never see. Training time and data cleanup usually cost more in year one than the software itself.
An LLM drafting audit narrative is safe exactly where it is confined to language, and risky exactly where that language starts carrying judgement nobody actually made.
Lock-in isn't a clause anyone points to. It's the absence of an export feature nobody asked about until the firm actually wanted to leave.
A trial run on the vendor's clean sample data proves nothing. Here's what it should actually be used to test before a firm commits further.
A sales demo shows the software at its best, on its own clean sample data. A trial is only useful if you deliberately try to break it with your own worst file.
A reference call that only asks "are you happy with it" gets a polite yes almost every time. Here's what actually surfaces the real answer.
An analytical procedure is only as good as the expectation it's measured against. Set the expectation after seeing the result, and the procedure proves nothing.
Hallucination on numeric tasks, where client data actually goes when it reaches a model, and why junior staff over-relying on fluent output is the risk firms underrate most.
The sequence that works: migrate data deliberately, pilot on one engagement before rolling out firm-wide, and configure methodology before anyone's deadline depends on it.
A worksheet a firm fills in with its own numbers: hours on repetitive matching, the value of partner time, and what that adds up to before and after.
The questions that separate a vendor worth trusting with client data from one that merely demos well: security, what's computed versus generated, exit terms, pricing, and India-specific fit.
Where client data physically sits, who inside a vendor can see it, and the difference between an architectural guarantee and a policy that could change tomorrow.
What actually changes for staffing and client relationships when testing moves off the year-end crunch, and where a year-end wrap-up is still unavoidable.
The rare but material exceptions full-population testing surfaces that sampling cannot, and the judgement about what an exception means that no tool replaces.
What a firm actually gains and loses leaving Excel, the version chaos Excel creates across a review chain, and a realistic first-engagement timeline.
The feature is usually present in the software and switched off, not missing. How to actually test which one is true before relying on it.
Why these, and not a blog
Each item exists because it answers a question we were asked by a practising auditor more than once — and each is useful to a firm that never speaks to us. They are grouped by topic because that is how they get used: nobody reads one purchase testing reference in isolation.
None of it is authoritative. Standards and statutory rules change, and every page says so and tells you to check the current text before relying on it in a file.
Rather than a PDF, there is a complete worked example in the product — a revenue testing paper with its population, sample basis, procedures, exception schedule, tickmark legend and sign-off block, exactly as Lekhya produces it.
If there is a reference your team keeps rebuilding by hand, tell us. If it is useful to more than one firm, we will write it and publish it here without a form in front of it.