How AI Is Changing Auditing in Real-World Practice

A client's accounts head asked me in March, only half joking, whether next year's audit would be done by software. Upload the books, let the system check them, collect the report. His auditor had mentioned "AI tools" once on the planning call and the idea had grown from there.

It doesn't work like that, and it won't for a while.

What actually shows up on an audit

In the SME and mid-market audits I see, the AI that turns up is modest. OCR reading purchase bills into a spreadsheet. A matching utility ticking the purchase register against GSTR-2B. Somebody on the team asking a chatbot to summarise the covenants in a 40-page sanction letter. Useful, all of it, and none of it anywhere near "the software did the audit".

The bigger firms are further along, but not as far as the conference talks suggest. A field study published in December 2025 by Kokina, Blanchette, Davenport and Pachamanova, based on interviews inside audit firms, found that simple machine reading and OCR were the tools genuinely in production. Most of the ambitious ones, such as AI suggesting which audit procedures to run, benchmarking an engagement against peers, or drafting financial statement narrative, were still in pilot. The same study noted that auditors mostly audit around a client's AI rather than through it, because they don't yet trust it enough.

So the gap between the talk and the practice is real. What AI does today is narrower, and more useful for being narrow: it reads documents, pulls figures out of them, compares one record against another, and points at what looks odd.

Documents first

Any audit file for a mid-sized business has hundreds of documents in it: purchase and sales invoices, credit notes, bank statements, loan papers, lease agreements and other contracts, plus the supporting schedules somebody built in Excel the week before fieldwork. Traditionally an article assistant reads each one and notes down whatever matters (invoice number and date, supplier, amount, tax details, contract dates, payment terms) so it can be ticked against the books.

AI can do that first pass and then compare what it extracted with another record. It is also good at reading a stack of similar documents for the ones that differ. A Thomson Reuters piece on the state of AI in audit this year put it simply: you're checking 100 leases and 15 of them are slightly different, and AI can do much of that work today. Nobody reached a conclusion there. Somebody found the 15 in a fraction of the time, and the reading of those 15 was still a person's job.

Scale that to purchases. Take 1,200 purchase invoices for the year, checked for invoice number, supplier, GSTIN, date and amount against the purchase entry. Once they are turned into structured data, the system flags amounts that differ from the ledger, repeated invoice numbers, dates that don't match the entry, supplier names that differ from the master, missing documents. Say that leaves 38 exceptions (the figures are illustrative, not a benchmark). The other 1,162 aren't cleared just because software went through them, but the team's hours now go to the 38 first.

Two flags that needed a second look

On a Guwahati distributor's audit last year, the matching tool marked two supplier invoices as duplicates. Same supplier, same amount, same date, and the junior had already drafted a query to the client. When we pulled the papers, one was for the godown in Guwahati and the other for the Jorhat depot. Two genuine purchases placed the same morning. The tool had done its job by finding something unusual; it just hadn't found anything wrong.

The opposite case worried me more.

An OCR pass read a faded thermal-paper bill as ₹18,400. The bill said ₹78,400, and the ledger said ₹78,400 too, so the tool reported a mismatch that didn't exist. It was caught because someone opened the image. Had the ledger been wrong in the same direction, the tool would have "confirmed" a bad entry and nobody would have looked. Every AI flag, and every AI tick, needs the question: what evidence is sitting behind this?

Pattern-finding is the other place it pulls its weight. Across a full year's general ledger, analytics can look at every entry rather than a sample: journals posted late at night, large round-number amounts, postings in the last days of March, rare ledger combinations, repeated amounts, unusual activity by one user. None of that is automatically an error, let alone fraud. A ₹25 lakh journal on 31 March can be perfectly valid. It goes on the list of things to ask about in planning.

If you run the business, this means more work, not less

Some owners hear "AI audit" and assume their auditor's better software means less effort on their side. It works the other way. As tools get better at comparing records, weak records get caught faster. If the purchase ledger says one thing and the invoice another, the gap shows up in minutes. If the same supplier exists under four spellings, automated matching falls over and the audit team goes back to doing it by hand, and bills for it. And if a document is missing, no system can create evidence from nothing.

What I tell clients to fix is unglamorous. Keep the supporting document for every transaction that matters, as a readable PDF or a straight scan, not a phone photo taken at an angle on the godown floor, and attach it or file it where it can be found against the voucher. Keep one clean master per customer, supplier and item, and merge the duplicates before year-end rather than after. Reconcile bank, receivables, payables and GST every month instead of in April. And have someone other than the person who posted them review corrections, backdated entries and large journals each month, with a note of why.

Bad data does not become good evidence because an AI tool read it.

Who changed that voucher, and when

An invoice goes in at ₹4.80 lakh. Two months later someone makes it ₹5.80 lakh. The balance today is one question; why it changed is usually the better one.

TallyPrime's Edit Log tracks creation, alteration and deletion of transactions and masters, with the user name and date and time of each activity, and the Differences Between Edit Log Versions report shows exactly what changed from one version to the next. What the auditor does next depends on what the log shows:

Businesses correct genuine mistakes every day, so an edit on its own proves nothing. With a few thousand changes in a year, though, sorting them by who, when and how late in the year is exactly the kind of filtering where software saves real time.

Cleaner records at entry, with TallyIra

AI helps most before the auditor ever arrives. Docs by Ira in TallyPrime reads PDF and image transaction documents and creates draft transactions from them, and through the TallyIra app, authorised users can scan or upload documents from a phone and send them to TallyPrime.

Draft is the word that matters. Imported transactions are reviewed before they become regular vouchers, and the Review Imported Transactions report shows exceptions such as missing masters, master mismatches, date mismatches and potential duplicates, with the underlying document open alongside. The duplicate question from the Guwahati and Jorhat invoices gets asked in the accounts office the week the bills arrive, not by an audit team twelve months later.

It isn't an audit feature, and it shouldn't be sold as one. It does mean the documents the auditor eventually asks for are already attached, already matched and already argued over.

Where I would draw the line

Reading documents, extracting data, matching, comparing, spotting exceptions and patterns, drafting summaries: AI can assist with all of that. I would keep it well away from fraud conclusions, going concern, management intent, the substance of related-party transactions, provision estimates, legal disputes, revenue recognition judgements and the audit opinion. Those need context that isn't in the data.

Take an overdue debtor of ₹40 lakh. The tool sees 180 days outstanding and marks it high risk. The auditor learns the customer is a government department, payment was stuck in an administrative approval, and ₹30 lakh came in after year-end. The provision conversation changes completely. A payment to a director's relative gets classed as suspicious and turns out to be approved by the board, disclosed, and priced at market. In both cases the ledger looked exactly the same before and after the auditor asked around.

SA 200 asks the auditor to plan and perform the audit with professional scepticism and to exercise professional judgement throughout. No software vendor has changed that, and the research on firm adoption is consistent that the final call on each flag stays with the auditor.

Before your next audit

Don't wait for your auditor to bring AI in. Work on what it will eventually read: supporting documents linked to vouchers, masters without duplicates, clear scans, monthly reconciliations, an internal look at unusual and backdated entries, and Edit Log switched on.

The same caution applies to what AI writes, not only what it reads. Teams are starting to use it to draft working-paper summaries, explanations for variances and first-cut observations. Anything it drafts has to be checked against the underlying evidence before it goes into the audit file, because a fluent paragraph can still carry a wrong figure, a conclusion nobody supported, or a clause lifted from a different client's agreement. A badly drafted note reads as confidently as a correct one.

AI will probably take a lot of dull work out of auditing, and good riddance. Nobody became a Chartered Accountant dreaming of comparing 500 invoice numbers by hand. Faster checking gets the auditor to the hard questions sooner, and those still need the documents, the client's side of the story and some scepticism before anything goes into the report.