Choosing an audit automation vendor well means going beyond the demo to ask five specific things: how client data is secured and where it resides, exactly which outputs are deterministically computed versus generated by a model, what happens to the firm's data and working papers if it ever leaves the vendor, how pricing actually scales with the firm's real engagement mix, and whether the vendor genuinely supports Indian-specific requirements like Tally exports and GST reconciliation rather than treating them as an afterthought.
Choosing the right audit automation platform in India specifically
The checklist below applies anywhere, but a firm evaluating an audit automation platform in India is also evaluating something most global tools treat as an afterthought: whether the vendor was actually built around Tally exports, GSTR-2B/2A reconciliation, the Companies Act audit trail rule, and the ICAI's confidentiality expectations — not whether those were bolted on later for an Indian release. Section 5 below is where that distinction shows up fastest.
Start here: what every other question depends on
A vendor evaluation built only around a feature walkthrough tends to compare the wrong things, because every vendor's demo is built to look good. The questions below are chosen because they are hard to fake in a sales conversation and because getting them wrong has consequences that show up long after the contract is signed, not during the trial.
1. Data security and residency
Client financial data moving into any cloud tool is a confidentiality decision under the ICAI Code of Ethics, regardless of how routine it feels. Ask specifically, not generally.
- Where is data physically processed and stored, and does any part of it — backups, logs, an AI feature — leave India?
- Is client data used to train the vendor's models or any third party's models? A no needs to be in the contract, not just a sales answer.
- Who inside the vendor can access client data, and is that access logged and scoped by role?
- Which sub-processors are involved, named specifically, including any AI provider behind a feature?
Regulatory requirement
Confidentiality obligations under the ICAI Code of Ethics attach to client information regardless of the medium. Personal data handling is separately governed by Indian data protection law, which has been evolving — confirm the current position before signing with any vendor.
2. What's computed versus AI-generated
This is the question most specific to this cluster, and the one a vendor's marketing is least likely to answer precisely unprompted. Totals, reconciliations, matching and variances should be produced by deterministic, rule-based code that gives the same answer on the same data every time. A model may reasonably be used to extract fields from documents, classify them, or draft narrative that a person reviews. A model should never be the thing producing a number the opinion depends on.
| Feature | Ask: is this computed by rule, or generated by a model? | Why it matters |
|---|---|---|
| Invoice field extraction | Usually model-based, and that's fine if every field is traceable to the source document | Verifiable extraction is safe even when a model produces it |
| GSTR-2B reconciliation | Should be rule-based matching, never a generated match decision | A reconciliation is arithmetic, and arithmetic must be deterministic |
| Risk or materiality suggestions | If model-generated, it must be clearly labelled as a draft for the auditor to accept or reject | A conclusion needs a named auditor's judgement behind it, not a generated suggestion presented as settled |
If a vendor cannot answer, feature by feature, which outputs are computed and which are generated, treat that as a material gap in the evaluation, not a minor one. It usually means the distinction was not a design decision in the first place.
3. Exit and data portability
A vendor evaluation almost never includes the question of what happens when the firm wants to leave, and this is precisely why it is worth asking before signing rather than after.
- 01Ask what format working papers and underlying data can be exported inA proprietary format that only the vendor's own software can open is a lock-in risk even if nothing else about the product is objectionable.
- 02Ask how long data remains accessible after a subscription endsA short window to retrieve historical files after cancellation can turn a routine vendor switch into a scramble against a retention deadline.
- 03Ask whether prior-year working papers remain usable without an active subscriptionRegulatory retention periods for audit files often outlast a single vendor relationship. Confirm the files remain retrievable regardless.
- 04Get the export and retention terms written into the contractA verbal assurance about data portability is not enforceable once the relationship has already ended.
4. Pricing model
Pricing structures across vendors differ in ways that matter more than the headline number: per-engagement, per-seat, per-client, or a flat firm-wide fee, each of which rewards or penalises a different firm shape.
- A per-seat model can get expensive for a firm with many junior staff touching the system briefly during busy season.
- A per-engagement model needs to be checked against the firm's actual mix of large and small clients, since a flat per-engagement fee may be a poor fit for a firm with many small, simple audits.
- Ask what happens to pricing as the firm grows, not just what the current tier costs — a model that scales awkwardly at twice the current volume is worth knowing about now.
- Ask whether support, updates and training are included or billed separately, since a low headline price with significant add-ons is not actually a low price.
5. Support for Indian-specific requirements
A tool built primarily for a different market and adapted for India will usually show its seams exactly where Indian audits differ most: Tally-format exports, GST reconciliation against GSTR-2B and GSTR-3B, and the audit trail requirement under the Companies Act.
- Can the vendor actually import a Tally export without heavy manual reformatting, for the versions of Tally the firm's clients actually use?
- Is GSTR-2B reconciliation a genuine line-level match, or a summary-level comparison dressed up as reconciliation?
- Does the vendor's own system maintain the kind of change history the audit trail requirement is concerned with, as a matter of course?
- Has the vendor dealt with the range of accounting software mid-market Indian clients actually run, or only the largest ERP systems?
Common practice, not a requirement
A useful test during any trial is to bring the vendor a genuinely messy real export from an actual client — inconsistent GSTINs, mixed voucher types, the kind of file described elsewhere in this library — rather than the vendor's own clean sample data. How it handles that file is more informative than any feature list.
How we think about this
The questions in this checklist share one property: they are all hard to answer well unless the vendor actually built the product around the right answer from the start. Lekhya's position on each of them — data residency and access stated plainly, computed arithmetic kept separate from anything a model produces, straightforward export, and real support for Tally and GST reconciliation — is set out on its security and pricing pages specifically so a firm can check rather than take it on trust.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Technology, data & AI in auditCloud audit software and data residency: what to askWhere client data physically sits, who inside a vendor can see it, and the difference between an architectural guarantee and a policy that could change tomorrow.
- Technology, data & AI in auditAI in audit: the risks and limitations auditors should knowHallucination on numeric tasks, where client data actually goes when it reaches a model, and why junior staff over-relying on fluent output is the risk firms underrate most.
- Technology, data & AI in auditAudit software ROI for small CA firms: how to think about itA worksheet a firm fills in with its own numbers: hours on repetitive matching, the value of partner time, and what that adds up to before and after.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.