Audit software security questionnaire: a buyer's checklist

A firm's own IT or compliance reviewer will ask six categories of question about any audit software vendor before sign-off — where data is hosted and whether it leaves India, who inside the vendor can access client files and how that access is logged, whether client data trains any model, what certifications or audits the vendor actually holds versus claims, how data is encrypted in transit and at rest, and what the incident-notification commitment is in writing — and a firm that gathers specific answers to each before the vendor conversation, rather than during it, closes the review in one meeting instead of three.

Why this review happens even at small firms

A sole proprietor or two-partner firm without a formal IT function still has an obligation under the ICAI Code of Ethics to protect client information, and that obligation doesn't disappear because there's no named security officer to raise it. The questions below are the ones a larger firm's IT reviewer would ask in a formal vendor-risk process; a smaller firm benefits from asking the same questions of itself before signing, even informally.

1. Data location and residency

• Where is the primary database physically hosted, by region and data center, not just by cloud provider name?
• Do backups, logs, or any AI-feature call leave that region, even transiently?
• If the vendor uses a third-party AI provider for any feature (document extraction, drafting), where does that provider process the data?
• Is there a written commitment to data residency in the contract, or only a verbal assurance from sales?

2. Access control and logging

• Which roles inside the vendor's own organisation can view client data, and is that list small and named rather than 'engineering' broadly?
• Is access to a specific firm's data logged, and can the firm request an access log for its own account?
• Does the vendor support role-based access within the firm's own account (partner vs. article vs. reviewer), and is that enforced, not just configurable?
• What happens to access rights immediately when a staff member leaves the firm — is deprovisioning the firm's responsibility alone, or does the vendor support SSO that makes it automatic?

3. AI and model training

• Is client data used to train or fine-tune any model, the vendor's own or a third party's?
• If a third-party AI API is used (for extraction, drafting, summarisation), does that provider's terms permit them to retain or train on the data passed through?
• Can the firm get a no-training commitment written into the contract, not just stated in a security page?

4. Certifications and audits — claimed versus held

5. Encryption and technical controls

• Is data encrypted at rest and in transit, and with what standard (this should be a specific, not a vague 'yes')?
• Are backups encrypted the same way as live data?
• Does the vendor support two-factor authentication for firm logins, and is it optional or enforced?

6. Incident response and notification

1. 01Ask what the vendor's written incident-notification timeline isA specific number of hours in the contract is worth far more than an assurance of being told 'promptly.'
2. 02Ask whether the firm would be notified even for an incident that didn't confirm data exposureA vendor that only notifies on confirmed breaches, not on investigated incidents, may leave a firm unaware of something still under review.
3. 03Ask who at the vendor the firm's IT reviewer can contact directly during an incidentA named security contact, not a generic support inbox, matters when speed is the point.