'AI-First' is Now Mandatory for Big 6 IT Audits, But They Don't Know How

Like every other industry, artificial intelligence is making a firm footing when it comes to auditing IT services and software-as-a-service firms. 

In IT firms, audits typically determine whether a computer system safeguards assets, maintains data integrity, enables organisational goals to be achieved effectively, and uses resources efficiently. Auditors review documentation, interview IT teams, run sample-based tests on controls, and produce findings. 

They are usually handled by the Big 6 audit firms, EY, KPMG, Deloitte, GT, BDO, and PwC, that handled 34% of the total companies listed on the NSE in FY25. The Indian audit industry itself is projected to grow at a 7% rate to $345 billion by 2022, per Mobility Foresights.

However, the conventional auditing process was designed for a slower, simpler era. When data no longer resides in a single place, and systems change continuously, periodic sampling audits struggle to keep pace. 

According to research by Orca Security, 76% of organisations have at least one public-facing cloud asset enabling lateral movement to high-value targets, while 32% of cloud assets run unsupported operating systems or go unpatched for over 180 days. 

The speed of cloud adoption often outpaces the maturity of security programmes, and a persistent skills gap makes it difficult for audit functions to develop the expertise needed to assess complex, multi-cloud architectures.

AI as Audit Tool

AI enables auditors to analyse large datasets, detect patterns, and automate routine tasks, allowing them to shift focus from data gathering to risk analysis and strategic recommendations. Modern AI systems can ingest financial data from virtually any source, PDFs, scanned receipts, Excel exports, and even handwritten invoices. They then detect anomalies and flag suspicious expense patterns that might indicate fraud. 

For Indian firms specifically, tools such as VIDUR AI, MindBridge, and AssureAI now recognise local bank formats, GST codes, and integrate directly with Tally and Zoho Books.

India's largest IT companies are already deep in this shift. Mphasis, Infosys, and Cognizant have received ISO 42001:2023 certification for AI management systems, accelerated by the National Accreditation Board for Certification Bodies. This standard sets out requirements for establishing, implementing, maintaining, and continually improving AI management systems within organisations.

KPMG in India too received the certification in December last year. In audit companies, AI tools are eliminating grunt work.

"AI audit tools at the Big Four level will eliminate significant portions of junior CA work, sampling, work paper documentation, risk flagging, within this decade," Chirag Pachisia, Equity Research Associate at SKP Securities, tells AIM. "EY's new platform specifically automates corporate risk assessments and pre-fills documentation. That's articleship work. That's what India's CA pipeline is trained to do for the first two years of their career."

The Regulatory Pressure Cooker

The urgency is not merely technological. It is regulatory. 

The Securities and Exchange Board of India’s (SEBI) February 2025 amendments inserted Regulation 16C, making any SEBI-regulated entity solely liable for the AI and ML tools it uses, whether built in-house or procured externally. This covers data privacy and security, the integrity of AI outputs, and compliance with applicable law. If an AI-driven trading algorithm misfires, the regulator will look to the firm, not the vendor.

Under India's 2025 AI Governance Guidelines, high-risk AI systems must undergo internal or third-party impact assessments before deployment, and companies must maintain audit trails to demonstrate compliance with the Digital Personal Data Protection Act. India's current approach favours voluntary commitments, self-certifications, transparency reports, and third-party audits, offering incentives such as sandbox access and reputational recognition before imposing stricter obligations.

For financial sector auditors, the complexity compounds further. The RBI has issued the FREE-AI framework to ensure explainability, auditability, and fairness in AI-driven financial decisions, while SEBI mandates transparency in algorithmic trading systems.

And yet a crucial gap remains. "None of this is audit-specific regulation. There is no Indian equivalent of the UK’s FRC guidance (on the use of AI in auditing) published last week. No framework that tells an Indian audit partner: here is how you validate AI output, here is what human oversight looks like, here is what happens if AI hallucinates, and you sign off anyway," explains Pachisia.

Ashwin Kumar, a product manager at revenue compliance platform RightRev, points to a broader accountability deficit. 

"AI is transforming auditing globally. EY, KPMG, and other Big Four firms are rolling out powerful AI tools that automate audit work papers, risk assessments, and transaction screening. The UK's regulator has just published the world's first guidance framework for AI in audit. But India's audit regulator, the National Financial Reporting Authority (NFRA), hasn't addressed it once, and this matters more here than anywhere else, given our history of high-profile audit failures like IL&FS Financial Services, DHFL, and Satyam," he notes.

Auditing AI, Not Just With It

Perhaps the most significant shift beyond using AI tools for auditing is that AI itself must be subject to audits.

Auditors must now assess IT general controls alongside AI governance frameworks, model validation processes, algorithmic bias, and third-party technology risks. Where AI affects people's opportunities or access to services, companies must provide meaningful explanations of automated decisions, conduct periodic bias and fairness audits, and ensure human oversight for high-risk use cases with documented review procedures.

ISACA, the global IT audit body, has responded by launching the Advanced in AI Audit (AAIA) credential. Auditors must ensure that AI tools adhere to frameworks such as COBIT (Control Objectives for Information and Related Technologies) and the NIST Risk Management Framework, validating model accuracy, maintaining proper documentation, and integrating audit trails for AI-driven decisions.

The structural problems within the profession itself cannot be overlooked, either.

"The six largest audit firms control over two-thirds of audits for Nifty-500 companies. Yet NFRA's own inspection reports of these firms flagged independence violations, weak documentation, inadequate professional scepticism,. partners holding securities of audit clients… related party transactions waved through," says Pachisia.

There is still no clarity on how AI decisions in audits should be reviewed, or how audit data should be stored under the Digital Personal Data Protection Act. 

“Most internal audit teams in India are not yet trained for AI, creating a significant learning gap that is both costly and time-consuming to close. AI is only as reliable as the data it has encountered, it cannot always adapt to novel situations, and unintended biases can creep in if its outputs are not carefully monitored by human auditors,” observes Shilpi Goyal, a chartered accountant.

Internal audit functions across India are increasingly deploying AI-driven analytics for continuous auditing, anomaly detection, fraud pattern recognition, and predictive risk assessment. Generative AI tools can enhance audit planning, automate control testing, and accelerate documentation reviews—but their deployment must be governed by clear policies addressing data privacy, explainability, model risk, and ethics.