Tax audit review in India has just got a lot wider. As reported by Financial Express, ICAI has increased the scale of its tax-audit scrutiny tenfold for Assessment Year 2024-25, expanding from 100 companies to 1,000 companies with turnover above ₹100 crore. Of the reports in scope, 867 have reportedly been examined already, with recurring deficiencies identified in reporting and compliance.
Watch our Crest.Digital News Bite on what the expansion could mean for audit quality, evidence management and compliance processes, then read on for the practical detail.
The figures come from press reporting and should be checked against ICAI’s own communications. The direction, however, is clear and consistent with how audit oversight is evolving globally: reviewers are moving from checking that a report exists to testing whether the work behind it holds together.
Crest.Digital’s Agentic GRC builds configurable AI agents that map requirements to evidence, chase gaps, track exceptions and keep an audit-ready trail, with human-in-the-loop review.
Explore Agentic GRCWhat ICAI’s Expanded Review Covers
The reported scope is broad. It spans tax audit reporting quality, Form 3CD disclosures, compliance with Income-tax Act requirements, adherence to ICAI reporting guidelines, recurring audit deficiencies, and whether corrective action is visible in subsequent filings. That last item deserves attention: it implies reviewers will look not only at one year’s report but at whether identified weaknesses were actually fixed the next time round.
Tax audit quality review sits with the Taxation Audits Quality Review Board, which ICAI established in 2018 to improve diligence in tax audits and certifications. According to its own description, it selects reports through random sampling, regulator references and media-flagged cases, and reviews them through a three-tier process of technical reviewers, quality review groups and the Board. Whether this expanded exercise is run through that structure is for ICAI to confirm, but the review model gives a useful picture of what scrutiny looks like.
Why Audit Quality Is Now an Evidence Problem
Form 3CD is the statement of particulars accompanying the tax audit report under Section 44AB of the Income-tax Act. It asks the auditor to report on a long list of specific matters, which means each answer is a factual assertion, and each assertion needs support. Recurring deficiencies in this kind of reporting rarely come from one dramatic error. They tend to come from small, repeated gaps.
Three patterns are common. First, evidence is assembled after the fact: working papers are gathered when the report is due rather than captured as the work is done, so linkages between a clause and its support are weak. Second, review is real but invisible: a senior person did check the work, but nothing records what was checked or on what basis. Third, exceptions disappear into email: queries are raised, answered and resolved in threads that never reach a register, so the next year repeats the same issue.
None of this is specific to tax. It is the same pattern internal audit teams see across controls testing, and it is why our work on continuous evidence and moving from sampling to continuous assurance applies directly. A report is only as strong as the trail underneath it.
The Requirement-to-Audit-Trail Chain
A structured workflow turns these gaps into a repeatable chain. Each link answers a question a reviewer is likely to ask, and each leaves a record. The chain below runs from the legal requirement through to a retained audit trail.
Requirement
Break the Income-tax Act, Form 3CD and ICAI guidance note obligations into discrete, testable requirements. A clause that cannot be stated as a requirement cannot be evidenced.
Evidence
Attach the supporting documents, extracts and workings to each requirement at the time the work is done, not reconstructed later. See our piece on moving from compliance documentation to evidence.
Review
Record who reviewed which clause, when and on what basis. A review that leaves no trace is hard to defend as a review.
Exception
Log differences, missing documents and judgement calls as exceptions with a severity, rather than resolving them silently in email threads.
Action
Assign each exception an owner and a due date, so follow-up does not depend on someone remembering.
Remediation
Fix the root cause, not only the single report. Recurring deficiencies usually point to a process gap upstream, which our guide to the audit issue remediation follow-up agent addresses.
Closure
Close an exception only with a test that proves the fix, and keep that test result with the record.
Audit Trail
Retain the complete chain from requirement to closure in one place, so the next reviewer, internal auditor or regulator can retrace it without a scramble.
The test of the chain is simple. Pick any Form 3CD clause and see whether you can move from the answer back to the requirement, forward to the evidence, and across to the reviewer and any exception, in minutes rather than days. If the answer depends on one person’s memory, the trail is not yet there.
Where Agentic AI Helps, and Where the Professional Stays in Charge
The volume of evidence work around an audit is what makes it fragile. Mapping clauses to documents, chasing process owners, reconciling ledgers to disclosures and tracking open items are repetitive, rule-bound tasks. They are exactly the work AI agents handle well, and they are the work that most often slips when teams are stretched at filing time.
Crest.Digital’s Voice AI for GRC can follow up on missing documents with process owners by phone, while Agentic GRC tracks exceptions and remediation to closure.
The boundary matters. Interpretation of the Income-tax Act, judgements on materiality and the final certification belong to the chartered accountant. Agents prepare, test, chase and record. People decide and sign. Every agent action should be logged so that the trail can be reproduced, which is the same expectation we set out in why AI agents need audit trails and in our guidance on agentic internal audit and evidence validation.
A Practical Playbook for CFOs, Auditors and Internal Audit
Six Moves Before the Next Review Cycle
- Sample your own reports: Pick a handful of last year’s Form 3CD clauses and trace each to its requirement, evidence, reviewer and any exception. The gaps you find are the ones a reviewer would find.
- Read the deficiency patterns: Group your internal findings by theme. Repeated weaknesses are a process signal, not a series of one-off errors.
- Capture evidence at source: Require supporting documents to be attached when the work is done, with a named owner for each requirement.
- Make review visible: Record reviewer, date and basis for every clause, and keep exceptions in a register rather than in inboxes.
- Prove remediation: Close actions only with a test and retain the result, so corrective action in the next filing is demonstrable.
- Report to the audit committee: Summarize quality trends, open exceptions and closure rates, so oversight does not depend on a single annual conversation.
A word of proportion. Expanded review does not mean every report is in doubt, and a structured workflow does not replace professional skill. What it does is reduce the cost of showing your work. For internal control over financial reporting teams, the same approach strengthens evidence for broader assurance, and Crest.Digital’s business impact page describes how organizations see measurable results from moving to evidence-led workflows.
Crest Perspective
Internal audit’s relationship with third-party risk has historically been reactive — reviewing incidents after they occur rather than providing assurance that controls are operating effectively in real time. Continuous monitoring creates a new opportunity: internal audit can verify that risk ratings are recalculated when trigger events occur, that escalations are documented, and that the board is receiving accurate information about vendor exposure — all of which are more meaningful assurance activities than an annual programme review.
Frequently Asked Questions
According to Financial Express reporting, ICAI has expanded its review of tax-audit reports tenfold, from 100 companies to 1,000 companies with turnover above INR 100 crore, for Assessment Year 2024-25. Reports say 867 reports have already been examined, with recurring deficiencies identified in reporting and compliance. The review is reported to cover tax audit reporting quality, Form 3CD disclosures, compliance with the Income-tax Act, adherence to ICAI reporting guidelines and corrective action in later filings. Readers should confirm figures against ICAI's own communications, as the numbers come from press reporting.
Form 3CD is the statement of particulars that accompanies the tax audit report under Section 44AB of the Income-tax Act, 1961. It asks the tax auditor to report on a long list of matters, from books of account and depreciation to loans, payments and disclosures that affect taxable income. Because it requires the auditor to certify specific facts rather than give a general opinion, it is a natural target for quality review: each clause answered should be backed by evidence that a reviewer can retrace. Weak clause-level support is one of the most common sources of reporting deficiencies.
ICAI set up the Taxation Audits Quality Review Board (TAQRB) in February 2018 as the wing that works to improve the quality of tax audits and certifications under direct and indirect tax laws. It selects reports through random sampling, references from regulators and cases flagged in the media, and uses a three-tier process of technical reviewers, quality review groups and the Board. Whether the current expanded exercise is run through that structure should be confirmed with ICAI's own announcements.
Treat the review as a prompt to test your own evidence trail before anyone else does. Take a sample of last year's Form 3CD clauses and check whether each answer can be traced to a requirement, a supporting document, a named reviewer, any exception raised and the action taken. Fix the gaps in the current cycle rather than waiting for a query. Where the same weaknesses recur year after year, move from manual checklists to a structured workflow with owners, deadlines and closure tests, so corrective action in subsequent filings is demonstrable rather than assumed.
AI agents are suited to the repetitive evidence work around an audit: mapping each requirement to the documents that should support it, chasing missing items from process owners, flagging inconsistencies between ledgers and disclosures, drafting exception notes and tracking remediation to closure. Professional judgement on materiality, interpretation of the Income-tax Act and the final certification stays with the chartered accountant. Crest.Digital's Agentic GRC follows this human-in-the-loop model and logs every agent action, so the review trail can be reproduced when a reviewer asks how a conclusion was reached.