RPA in audit is genuinely useful for repetitive, rule-based, high-volume steps that follow an identical sequence every time — logging into a portal and downloading a report, copying figures from one system's screen into a standard template, running the same export on a fixed schedule — and it breaks down quickly the moment a step requires judgement about what an exception means, because a bot scripted to click in fixed positions has no way to reason about something it wasn't scripted for.
What RPA actually is, for firms that haven't used it
RPA software records or scripts a sequence of UI interactions — clicks, keystrokes, field entries — and replays them, usually against the same screens a human would use, rather than through an API. That distinction matters: RPA automates the interface a person uses, not the underlying logic, which is exactly why it is powerful for repetitive interface work and fragile for anything that needs actual reasoning about content.
Genuinely good uses in an audit practice
- Scheduled extraction of a report from a client's portal or ERP screen on a fixed cadence, when no API access exists.
- Repopulating the same standard template from the same source fields every time, for engagements with a consistent file format.
- Bulk downloading or renaming large batches of supporting documents according to a fixed naming convention.
- Running an identical check across dozens of client files where the check itself needs no judgement, just repetition.
Where it breaks down
- Any step where the source screen's layout, format, or content varies client to client, since the bot was scripted against one specific layout.
- Deciding whether an unmatched item in a reconciliation is a timing difference, an error, or something needing follow-up — that's interpretation, not repetition.
- Any step where the underlying system updates its interface, silently breaking a script that was never designed to notice the change.
- Tasks that look repetitive on the surface but actually contain a judgement call buried in a small fraction of cases — RPA will apply the same mechanical step to those cases too, silently, unless someone builds in an exception path.
| Capability | RPA | What's needed instead |
|---|---|---|
| Repeating an identical click sequence | Strong fit | — |
| Extracting a field from a varying document layout | Weak — brittle to layout change | Model-based extraction with confidence flags |
| Classifying why two figures don't match | Cannot do this at all | Rule-based matching plus human or model triage |
| Noticing the source screen changed | Fails silently, usually | Monitoring and alerting built around the script |
The most common RPA failure in audit practice isn't dramatic — it's quiet. A script keeps running after the source screen changes slightly, and it extracts the wrong field without erroring out, because nothing told it the layout had moved.
How we think about this
Lekhya's architecture favours API-level integration with accounting systems over screen-scraping RPA wherever an API exists, precisely because an API contract breaks loudly when it changes, while a scripted UI click often breaks silently. Where no API exists, RPA still has a place — but as a narrow, monitored tool, not the backbone of the workflow.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Audit workflow & automationAutomating repetitive audit procedures without automating judgmentWhere the boundary between mechanical work and judgment falls, a test for deciding which side a task is on, and how to keep the boundary from eroding.
- Technology, data & AI in auditAI in audit: the risks and limitations auditors should knowHallucination on numeric tasks, where client data actually goes when it reaches a model, and why junior staff over-relying on fluent output is the risk firms underrate most.
- Audit workflow & automationAudit automation for CA firms: what to automate firstHow to decide what to automate, ranked by return rather than by how impressive it sounds, with a scored ranking of common audit tasks and what to leave alone.
- Audit data & extractsValidating an audit population before you draw a sampleA sample drawn from an unvalidated population tells you something precise about the wrong set of transactions. The checks that establish a population is actually a population, before any sampling begins.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.