Digital signatures and e-sign are not interchangeable in audit documentation: a Class 3 digital signature certificate, issued by a licensed certifying authority and tied to a verified individual's identity, is what's required for signing the statutory audit report itself, while a simpler e-sign or click-to-accept method may be adequate for lower-stakes internal documents but offers materially weaker evidence of who actually agreed to what, and using it where real authentication matters quietly undermines the document's evidentiary value.
The distinction that matters
'Digital signature' and 'e-signature' get used loosely as synonyms, but they describe different mechanisms. A digital signature, in the Class 3 sense used for statutory filings, is cryptographically tied to a certificate issued after identity verification by a licensed authority, which is what gives it strong evidentiary weight about who signed and that the document wasn't altered after signing. An e-signature can be as simple as typing a name into a box or clicking 'I agree,' which is legally recognised for many purposes but proves far less about who was actually at the keyboard.
Where a Class 3 digital signature is required or clearly appropriate
- The statutory audit report itself, and other filings that require a digital signature under the applicable regulatory framework for company filings.
- Any document whose authenticity and signer identity could later be disputed and needs to withstand that scrutiny.
Where a simpler e-sign may be adequate
- Internal engagement checklists and sign-offs between staff within the firm, where the identity of the signer is not genuinely in question.
- Routine internal approvals that don't carry independent evidentiary weight outside the firm.
Engagement letters and management representation letters sit in a genuinely sensitive middle ground — they're not statutory filings requiring a Class 3 certificate, but their whole purpose is establishing exactly who agreed to what and when, which is precisely the evidentiary question a weak e-sign method answers poorly. A click-to-accept representation letter is worth less as evidence than a properly executed signature, digital or physical.
| Document | Appropriate method | Why |
|---|---|---|
| Statutory audit report | Class 3 digital signature certificate | Required by the applicable filing framework; strong identity binding |
| Management representation letter | Digital signature or wet signature, not a bare click-to-accept | Its entire purpose depends on provable, specific agreement by a named individual |
| Engagement letter | Digital signature preferred; e-sign acceptable if identity verification is otherwise solid | Establishes the scope and terms the whole engagement rests on |
| Internal staff checklist sign-off | Simple e-sign is usually adequate | Identity of the signer is not genuinely in dispute internally |
Regulatory requirement
Requirements around which filings specifically need a Class 3 digital signature are set by the relevant regulatory framework for company filings and can change. Confirm the current requirement before relying on any signing method for a statutory document.
How we think about this
Lekhya's view is that the signing method should match how much the document's evidentiary weight actually depends on proving who signed — not simply whichever method is fastest to click through.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Audit documentationEngagement letters: what SA 210 requiresWhat an engagement letter must establish, when it needs renewing, and the gaps most often found on file inspection — undated letters and stale scope.
- Audit documentationSA 580: written representations, and why they're not a substitute for evidenceA signed representation letter is not evidence that something is true. It's evidence that management told you it was true — a different and much weaker thing.
- Audit documentationAn audit documentation checklist for statutory auditsA checklist organised by when the work happens: planning, fieldwork, each paper, completion and assembly, with the deadlines that govern the last two.
- Technology, data & AI in auditThe audit trail rule: what accounting software must doThe feature is usually present in the software and switched off, not missing. How to actually test which one is true before relying on it.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.