UDIN has to be generated for every certificate, report, or document a member in practice signs that falls within ICAI's mandated categories — audit reports, certificates for banks, GST, and other attest or assurance functions — within 60 minutes of signing for most documents, or within 15 calendar days for bulk documents like certificates issued in volume, and the most common compliance failure is not fraud or misuse but simply generating the UDIN late, after the document has already left the firm.
What has to happen, in order
- 01Classify the document correctly on the UDIN portalAudit report, certificate, or other attest function — each has slightly different mandatory fields, and misclassifying leads to a mismatch when the document is later verified.
- 02Generate the UDIN within the time limit60 minutes for most documents from the time of signing; up to 15 days for specified bulk-issuance certificates — but the clock starts at signing, not at the point the document is actually delivered.
- 03Print or affix the UDIN on the document before it is issuedA document that goes out without the UDIN printed on it, even if one was generated separately, defeats the purpose and will not match on verification by a third party checking the portal against the physical document.
- 04Keep the figures used to generate UDIN consistent with the final signed documentIf a figure in the report changes after the UDIN is generated (a late adjustment, a corrected total), the UDIN has to be revoked and regenerated against the final version — an unrevoked UDIN against a superseded draft is a mismatch waiting to be found.
Mistakes that actually get flagged
| Mistake | Why it's flagged |
|---|---|
| Generated after the 60-minute / 15-day window | Timestamp on the portal doesn't match the document's signing date — this is checked automatically, not discretionarily |
| Wrong document category selected | Fields captured don't correspond to what the actual document contains, so third-party verification shows a mismatch |
| Document amount or key figures don't match the UDIN record | A figure changed after generation and the UDIN wasn't revoked and regenerated |
| UDIN not printed on the final issued document | Recipient (bank, ROC, GST authority) cannot verify the document even though a valid UDIN technically exists in the system |
| One UDIN reused across multiple distinct documents | Each signed document needs its own UDIN — reuse across similar-looking certificates for different clients or periods is treated as misuse |
UDIN cannot be generated retrospectively to cover a document already issued without one — if the window is missed, the correct response is to revoke and properly document the lapse, not to generate a UDIN with a backdated reference to make the record appear compliant.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Audit documentationEngagement letters: what SA 210 requiresWhat an engagement letter must establish, when it needs renewing, and the gaps most often found on file inspection — undated letters and stale scope.
- CARO & Companies ActSecretarial compliance checklist for a statutory auditorBoard meeting frequency, statutory registers and ROC filing timeliness, read as evidence of compliance culture rather than a secretarial checklist in its own right.
- Audit documentationAn audit documentation checklist for statutory auditsA checklist organised by when the work happens: planning, fieldwork, each paper, completion and assembly, with the deadlines that govern the last two.
- Audit documentationReviewing and signing off audit working papersWhat a reviewer is responsible for, a defensible review order, writing points that get cleared properly, and why approval must lapse when the paper changes.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.