The most-downloaded statutory audit checklists in India are from 2009-2013 – written before CARO 2020, before the audit-trail rule, before 43B(h), before the SQM deferment. This free Audit Documentation Pack is one Excel workbook built for FY 2025-26 audits: an SA-wise statutory audit checklist, an area-wise audit programme with a Form 3CD add-on, India’s first CARO 2020 applicability tester (enter seven figures – every clause switches on or off), the SA 230 file index with a live 60-day assembly countdown, and a UDIN register that counts your tax audits against the new 60-per-partner ceiling. No login, no paywall.
What is inside the statutory audit checklist pack
CARO 2020 applicability tester
Enter paid-up capital, reserves, revenue, peak borrowings and a few flags. The sheet rules on the small-company and private-company exemptions – with the exact temporal limbs (borrowings tested at their PEAK during the year) – and switches each of the 21 clauses to Yes or N/A, including the Nidhi, NBFC, cost-records, CSR and consolidated-only clauses. It also rules on IFC reporting u/s 143(3)(i).
Audit programme – 18 areas + tax audit add-on
Share capital to going concern, three to six procedures per area with WP references and sign-offs, ending in a completion block. The tax-audit add-on maps each step to its Form 3CD clause – 43B(h) to clause 22, cash loans to clause 31, TDS to clause 34, the clause 44 break-up and the GST-books reconciliation.
SA + Companies Act checklist
The documentation every Standard on Auditing demands (SA 210 to SA 580), the section 143(3)(a)-(j) report items, Rule 11 including all four audit-trail assertions, and an acceptance gate covering section 144 prohibited services, rotation and the communication with the previous auditor.
SA 230 file index + 60-day clock
Permanent-file and current-file indexes for every mandatory paper. Type your report date – the sheet computes the 60-day assembly deadline, the days remaining and the 7-year retention date, with a post-assembly modification log.
UDIN register with the 60-audit ceiling
Log every signature: the sheet checks the 60-day generation window, the e-filing update window, and counts each partner’s tax audits against the 60-per-partner cap that took effect on 1 April 2026 – warning you from 55.
Actually current for FY 2025-26
CARO 2020 unamended, Rule 11(g) including trail preservation, Form 3CD as amended by Notification 23/2025, the ICAI deferment of SQM 1/2 (SQC 1 still governs), and the UDIN ceiling guidelines – checked July 2026.
Is CARO 2020 applicable to private limited companies?
CARO 2020 applies to every company – unless an exemption fits. The workbook tests these automatically; here is the rule the tester runs:
| Exempt category | Condition |
|---|---|
| Excluded classes | Banking companies, insurance companies, section 8 companies and One Person Companies – always outside CARO |
| Small company | Private company with paid-up capital up to Rs 4 crore AND turnover up to Rs 40 crore (and not a holding or subsidiary of any company, not section 8) |
| Qualifying private company | ALL four: not a holding or subsidiary of a public company; paid-up capital plus reserves up to Rs 1 crore on the balance-sheet date; borrowings from banks or financial institutions up to Rs 1 crore AT ANY TIME in the year; total revenue up to Rs 10 crore for the year |
| Consolidated statements | CARO does not apply to the CFS report – except clause (xxi), which collects the group companies’ CARO qualifications |
| LLPs | Never – CARO is made under the Companies Act and does not reach LLPs |
The 60-day rule under SA 230
Audit trail reporting under Rule 11(g) – the four assertions
For FY 2025-26 the auditor reports on all four: the accounting software has an audit-trail (edit-log) feature; it operated throughout the year for all transactions; it was not tampered with; and the trail has been preserved for the statutory retention period – which now includes the prior years’ trails from FY 2023-24 onward. A recent review found modified audit-trail reporting in the majority of surveyed companies – this is a scrutiny magnet, and the checklist carries each assertion as a separate line.
UDIN in the 2026 audit season – three numbers to remember
| Rule | Limit |
|---|---|
| Generate the UDIN | Within 60 days of signing (regulators can set shorter windows); update it on the e-filing portal within 60 days or the form fails |
| Revoke a UDIN | Only within 48 hours of generating it |
| Tax-audit ceiling | 60 tax audits u/s 44AB per partner per year from 1 April 2026 – 44AB(a)/(b) audits count, presumptive opt-out audits do not, and the UDIN portal itself blocks the 61st by signing date |
Statutory audit checklist – FAQs
What should a statutory audit checklist cover for FY 2025-26?
Four layers: the documentation each Standard on Auditing demands (engagement terms, risk assessment, materiality, evidence, representations); the section 143(3) report items; the Rule 11 matters including the four audit-trail assertions; and CARO 2020 where it applies. The pack carries all four as separate parts of one checklist tab, plus the area-wise programme that generates the evidence.
Is CARO 2020 applicable to my private limited company?
Only if no exemption fits. Small companies (capital up to Rs 4 crore and turnover up to Rs 40 crore) are out, and so is a private company that passes all four limbs – no public-company linkage, capital plus reserves up to Rs 1 crore, peak bank borrowings up to Rs 1 crore at any time in the year, and revenue up to Rs 10 crore. The workbook’s tester applies these – including the peak-borrowing trap – and switches all 21 clauses accordingly.
Which CARO clauses apply only to some companies?
Clause (vi) cost records only where section 148 prescribes them; clause (xii) only to Nidhi companies; clause (xvi) to NBFCs and Core Investment Companies; clause (xx) where CSR applies; and clause (xxi) only in the report on consolidated statements. The tester switches each of these off unless its flag is on.
What is the 60-day rule for audit files?
SA 230 requires the final audit file to be assembled within 60 days of the auditor’s report date and kept for at least 7 years. The File Index tab computes both dates from your report date and counts down the days.
Is audit trail reporting mandatory for FY 2025-26?
Yes. Rule 11(g) reporting has applied since FY 2023-24, and from FY 2024-25 it includes whether prior years’ trails were preserved. The auditor reports on the feature existing, operating throughout the year for all transactions, not being tampered with, and being preserved for the statutory retention period.
Does SQM 1 apply to my firm this audit season?
No – ICAI deferred SQM 1 and SQM 2 on 31 March 2026, until further announcement. SQC 1 remains the mandatory quality-control standard for FY 2025-26 files, and the pack is built on it. Adopting SQM voluntarily remains open.
When is internal financial controls reporting not required?
For a private company that is an OPC or a small company, or has turnover below Rs 50 crore per the latest audited accounts AND borrowings – from banks, financial institutions or any body corporate – below Rs 25 crore at any time during the year. The exemption is lost if the company has defaulted in filing its financial statements or annual return. The tester rules on this alongside CARO.
What is the UDIN limit for tax audits from April 2026?
Sixty tax audits under section 44AB per partner per year, counted across individual capacity and all firms, and not poolable between partners. Audits under 44AB(a) and (b) count; presumptive opt-out audits under 44AB(c), (d) and (e) do not; head office and branches of one assessee count once. The UDIN portal enforces the cap by signing date – the pack’s register counts each partner live.
Within how many days must a UDIN be generated?
Within 60 days of signing the document, and it must also be updated on the income-tax e-filing portal within 60 days or the uploaded form is treated as invalid. Revocation is possible only within 48 hours. The register flags all three windows.
What is the difference between the statutory audit and tax audit programme?
The statutory programme is risk- and assertion-driven under the SAs and the Companies Act; the tax-audit add-on verifies what Form 3CD reports – 43B payments, MSME dues under 43B(h), cash loans under 269SS/269T, cash expenses under 40A(3), TDS compliance, ICDS and the clause 44 break-up. The pack keeps them in one programme so the same evidence serves both files.
What goes into the permanent audit file vs the current file?
Permanent: constitution documents, appointment papers, continuing agreements, title-deed lists, related-party and shareholding records, prior years’ statements and the systems note. Current: this year’s planning, execution and completion papers. The File Index tab lists every mandatory item under each.
Is this pack a substitute for the ICAI formats?
No – it is a working companion. All wording is original and paraphrased from the law and standards; answer final positions against the bare text of CARO 2020, the SAs and the Act. Think of it as the Excel discipline layer that keeps the file complete, current and assembled on time.
Method and version notes: v1.0, prepared and reviewed July 2026 for FY 2025-26 audits. Built on CARO 2020 (S.O. 849(E), unamended since Dec-2020), the small-company thresholds of G.S.R. 700(E), the IFC exemption of G.S.R. 583(E), SA 230 and SQC 1 (SQM 1/2 deferred by ICAI on 31-Mar-2026), Rule 11 of the Companies (Audit and Auditors) Rules including clause (g), Form 3CD as amended by CBDT Notification 23/2025, and the ICAI tax-audit ceiling guidelines effective 1-Apr-2026. All wording is original – nothing is reproduced from ICAI or MCA publications. The workbook is protected with inputs unlocked; formulas were verified against an independent scenario battery before release. A season refresh will follow if any of the above changes.