A CARO 2020 reporting checklist works best organised by topic area rather than by clause letter, because the clause lettering is what people misremember and the underlying subject matter is what actually drives the audit work. The order covers fixed assets and inventory, investments and loans given, compliance with deposit and loan-taking rules, statutory dues, utilisation of borrowed funds, fraud and whistle-blower matters, and a handful of other company-law and governance checks. This article walks through each topic area and what evidence supports it; exact clause numbers should always be confirmed against the current order text before the report is drafted.
Why clause numbers are the wrong thing to memorise
The Companies (Auditor's Report) Order has been reissued and renumbered before, and sub-clauses within a single paragraph get added or split between editions. A checklist built around "clause (viii)" is fragile in a way a checklist built around "statutory dues" is not. Treat this article as a map of subject areas. Before the report goes out, every clause reference should be checked word for word against whichever version of CARO is in force for that financial year, because the firm's own standard format letter can lag a change in the order by a cycle if nobody checks.
Do not copy a CARO clause number from last year's file into this year's report without checking it against the current order. Numbering has changed between versions before, and a stale clause reference in a signed report is the kind of error a regulator reviewer finds in minutes.
The topic areas, and what each needs
| Topic area | What the auditor reports on | Evidence to assemble |
|---|---|---|
| Fixed assets and intangible assets | Whether records of property, plant and equipment are maintained properly, whether physical verification was carried out, whether title deeds are held in the company's name, and whether assets were revalued | Fixed asset register, physical verification report, title deed schedule, revaluation report if any |
| Inventory | Whether physical verification of inventory was conducted at reasonable intervals and whether discrepancies against book records were properly dealt with | Stock-take records, reconciliation of count to books, variance analysis |
| Investments, loans, guarantees and advances | Terms of loans and advances given, whether they are prejudicial to the company's interest, overdue amounts and whether overdue loans were renewed or extended | Loan ledger, sanction terms, ageing of receivables on loans given, board approvals |
| Deposits | Whether the company has complied with provisions on acceptance of deposits | Deposit register, compliance filings, legal opinion if deposit status is contested |
| Maintenance of cost records | Whether cost records are required and maintained | Applicability assessment, cost record extracts where required |
| Statutory dues | Timely deposit of undisputed statutory dues, and particulars of disputed dues not deposited | GST, TDS, PF, ESI and other statutory ledgers reconciled to payment proof; disputed dues schedule with forum and status |
| Default in repayment of loans and borrowings | Whether the company has defaulted in repayment of loans or borrowings to a bank, financial institution or government, or in payment of interest | Loan repayment schedules, bank confirmations, lender statements |
| Utilisation of funds raised | Whether term loans were applied for the purpose for which they were raised, and whether funds from preferential allotment were used as stated | Sanction letter purpose clause, fund flow statement, board resolutions on application of funds |
| Fraud and whistle-blower matters | Whether any fraud by or on the company was noticed or reported, and whether whistle-blower complaints were received | Minutes referencing fraud, internal audit fraud register, whistle-blower complaint log |
| Related party transactions and managerial remuneration | Compliance with the sections governing related party transactions and managerial remuneration, to the extent CARO calls for comment | Related party register, approvals, remuneration computation |
| Other matters: NBFC registration, CSR, resignation of auditors, going concern indicators | Various standalone reporting points that apply depending on the company's facts | Entity-specific supporting schedules |
Working through the checklist in practice
- 01Confirm applicability firstCARO does not apply to every company and has size and category exclusions. Confirm applicability against the current thresholds before building out the rest of the file; thresholds should be checked against the Companies Act and current order text rather than assumed from memory or last year's file.
- 02Build one evidence folder per topic areaRather than one working paper titled CARO, keep a folder per topic area above, each with its own evidence, so a reviewer can see what supports each line of the report without reading the whole file.
- 03Cross-reference to the substantive audit sectionsFixed assets CARO points link to the fixed asset audit, statutory dues to the payroll and GST reconciliation sections, loans given to the related-party review. Most of the evidence already exists elsewhere in the file; CARO reporting mostly reorganises conclusions already reached, rather than generating new ones.
- 04Draft the clause responses lastWrite the actual CARO paragraph only after every topic area's evidence is assembled and the clause numbering has been checked against the current order. Drafting clause language early, before the evidence is in, is how a report ends up saying something the file does not support.
Regulatory requirement
CARO applicability, the exact clause structure, and the current thresholds for exemption are set out in the Companies (Auditor's Report) Order as amended and the Companies Act. Confirm the current text and clause numbers directly against that order before relying on any clause reference in this article or in a prior year's file.
Where this checklist goes wrong in practice
- Statutory dues reported as timely deposited based on a ledger that was never reconciled to actual payment proof for every head of dues.
- Fixed asset title deed verification skipped because the register was assumed unchanged from the prior year.
- Loans given to related parties tested for sanction terms but never aged, so an overdue renewal pattern is missed entirely.
- Fraud and whistle-blower reporting answered from memory rather than from a documented enquiry with those charged with governance.
- Clause numbers copied forward from the prior year's signed report without checking the current order.
How we think about this
Most of what CARO asks for is a reconciliation, a cross-check or an ageing calculation applied consistently across a full population: statutory dues against payment proof, loan schedules against repayment dates, vendor registers against statutory thresholds. That part should be computed the same way every time, on the full population, not sampled. What a computer cannot do is decide whether an overdue loan renewal is a genuine commercial accommodation or a pattern worth escalating, or whether a disputed tax demand belongs in the disclosure. That judgement stays with the auditor; the checklist's job is to make sure the evidence for it is complete before that judgement gets made.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- CARO & Companies ActCARO fixed asset and inventory clauses: what auditors testWhat the fixed asset and inventory points under CARO actually require in evidence: physical verification, title deeds, revaluation, and count discrepancies.
- CARO & Companies ActCARO statutory dues clause: testing approachHow to test timely deposit of statutory dues for CARO reporting, handle disputed dues disclosure, and avoid redoing work already done in the GST and payroll sections.
- CARO & Companies ActCARO whistleblower and fraud reporting clausesThe auditor's reporting responsibility on fraud noticed and whistle-blower complaints received, and how to document the enquiry behind it.
- CARO & Companies ActCARO clause on loans, advances and investmentsTesting loans, advances and investments given by the company for CARO reporting, including the overdue-loan-renewal pattern the clause is designed to surface.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.