CA. Ankit Jallan | Internal Audit in a Digital World | 10-10-26
Internal Audit in a Digital World: the kit
Prompt library, synthetic datasets, Excel toolkits and Python tools from the Guwahati session.
All data here is synthetic. The companies, people, PAN, GSTIN, mobile and account numbers are fictitious. Before using any prompt with real client data, minimise and mask it (DPDP Act 2023) and use a business-grade AI account.
Python setup: pip install pandas openpyxl numpy. Keep datasets/ and tools/ side by side, then run python tools/aluminium_audit.py. Reports appear in outputs/.
Challenge: exceptions are hidden in each dataset. Find them with the prompts or the tools before you open the reports.
Prompt library
Replace the facts with your client's, and verify every output.
1. Understand the business before the first voucher
You are a senior internal auditor (Chartered Accountant) in Guwahati.
Client: a private limited company that buys aluminium billets, extrudes sections, and sells
ACP panels, office partitions, sliding/casement windows and doors to dealers and builders
across Assam and the North East. Turnover approx Rs 60 crore. Accounting in Tally.
1. Explain the business cycle from billet purchase to installation in 8-10 steps.
2. For each step list the key internal-audit risks specific to THIS industry
(e.g. yield/scrap, LME-linked pricing, site installation billing, dealer credit).
3. Give the 10 data fields I should request from Tally/ERP for each step.
Output as a table: Step | Risks | Data to request | Suggested analytics test.
If you are unsure about any industry norm, say so instead of guessing.
2. Risk-control matrix & audit programme in one pass
Using the risks you identified, prepare a Risk & Control Matrix for the
Procure-to-Pay cycle of the aluminium client.
Columns: Risk ID | Risk | Likelihood (H/M/L) | Impact (H/M/L) | Expected control |
Control type (preventive/detective, manual/automated) | Test of control |
Substantive / data-analytics test | Data source (Tally report / ERP table).
Then convert it into an internal audit programme aligned to ICAI Standards on
Internal Audit: objective, scope, procedures, sample/100% approach, evidence to
retain in working papers. Company policies: GM can approve payments up to
Rs 2 lakh, above that Director; vendor creation needs PAN + GSTIN + cancelled cheque.
3. Ask Claude to analyse the data you uploaded
Attached: Sales_Register and Customer_Master for FY 2025-26
(synthetic / masked). Company policy: maximum trade discount 5%;
office closed Sundays; financial year ends 31-Mar-2026.
Act as an internal auditor. Test 100% of invoices for:
a) discount above policy, and which salesperson gives it
b) invoices dated on Sundays
c) duplicates (same customer, date, item, qty, value)
d) gaps in invoice numbering
e) cut-off: invoiced in March but dispatched in April
f) inter-state supply charged CGST+SGST instead of IGST
Show each exception list as a table with invoice numbers, then a
summary of patterns. State exactly how you tested each one.
4. Policy / SOP gap review against best practice
Attached is the client's "Purchase & Vendor Management Policy" (8 pages).
1. Compare it with good practice for a manufacturing SME in India:
vendor onboarding (PAN/GSTIN validation, bank verification, related-party
declaration), segregation of duties, approval matrix, 3-way match,
rate contracts for commodity inputs linked to market benchmarks.
2. List gaps as: Policy clause | Gap | Risk | Recommended wording.
3. Flag clauses that conflict with each other.
4. Draft 5 questions I should ask the purchase head in the walkthrough.
Quote the exact clause numbers from the document; do not paraphrase as if quoted.
5. Reading invoices, e-way bills and agreements
Attached are 12 scanned purchase invoices and e-way bills
for aluminium billets.
Extract into a table: Supplier | GSTIN | Invoice no | Date |
Item | Qty (kg) | Rate | Taxable | GST | E-way bill no |
Vehicle no | Distance.
Then flag: GSTIN format errors, invoice date after e-way bill
date, qty mismatch between invoice and e-way bill, rate
outside Rs 245-275/kg, the same vehicle used on the same day
for two far-apart deliveries.
6. Reading invoices, e-way bills and agreements
Attached: installation contract with a builder for
aluminium windows at a residential project (14 pages).
Summarise: scope, rates, escalation clause (LME-linked?),
milestone billing, retention money, defect liability period,
liquidated damages, payment terms, termination.
Then tell me which audit tests apply: unbilled milestones,
retention receivable ageing, LD exposure, revenue recognition
(Ind AS 115 / AS 7) issues.
7. From exception list to a well-written observation
Draft an internal audit observation in 5C format
(Condition, Criteria, Cause, Consequence, Corrective action)
plus Risk rating and Management response placeholder.
Facts: vendor V031 "Shree Ganesh Metal Pvt. Ltd." was created
on 18-07-2025 by user PUR_BIKASH with the same PAN, GSTIN and
bank account as existing vendor V001 "Shri Ganesh Metals Pvt Ltd".
Two advances of Rs 3.5 lakh and Rs 4.1 lakh were paid to V031
with no invoice. Vendor creation SOP requires accounts approval.
Tone: factual, non-accusatory, suitable for the audit committee.
Do not conclude fraud; recommend investigation steps.
8. Audit committee summary, then "build me a tool"
Attached is the exception report (Summary sheet) from our
data analytics on FY 2025-26.
Write a one-page summary for the Audit Committee:
- top 5 issues by financial impact with Rs amounts
- 3 control themes (e.g. vendor master, approvals, audit trail)
- what management must do in 30 / 60 / 90 days
Plain English, no jargon, no names of individuals.
9. Audit committee summary, then "build me a tool"
[Claude Code - in a project folder]
Read datasets/01_Aluminium_Brahmaputra_Alu_Systems.xlsx.
Write a Python tool aluminium_audit.py that tests 100% of
the data for: invoice gaps, duplicates, discounts > 5%,
cut-off, wrong GST type, duplicate vendors, vendor bank =
employee bank, GSTIN checksum, 3-way match, GSTR-2B recon,
split payments below Rs 2L, self-approved and late-night
journals, yield < 82%, and Benford's law.
Output one Excel report: Summary sheet + one sheet per test.
Then run it and show me the summary.
10. DPDP readiness as an internal audit area
Prepare a DPDP Act 2023 / DPDP Rules 2025 readiness audit checklist for a 150-bed private hospital in Assam. Columns: Area | Requirement (cite section/rule) | Evidence to inspect | Status (Y/N/Partial) | Observation. Flag where you are unsure of the exact rule number.
11. Co-op Bank · IRAC & evergreening
Attached: Loan_Book and Closed_Loans (synthetic / masked). As at 31-03-2026, recompute days past due from Overdue_Since and classify: <=90 Standard, 91-455 Sub-Standard, >455 Doubtful. List accounts where the computed class differs from Asset_Class_Reported, with indicative provision (10% / 25%). Then find customers whose old loan (DPD > 30 at closure) was closed within 7 days of a new sanction (evergreening). Explain your method.
12. Co-op Bank · KYC / AML red flags
Attached: KYC_Register (masked). Find: mobile numbers shared by 3+ customers, the same PAN under different customer IDs, and re-KYC overdue as at 31-03-2026 (High risk 2 yrs, Medium 8, Low 10 from Last_KYC_Date). Summarise by branch and risk category. Suggest 5 follow-up procedures.
13. Hospital · revenue leakage
Attached: IPD_Bills, Consumables_Issue, TPA_Claims, Doctor_Payouts, Doctor_Master (masked). Find: discounts > 10% not approved by MS_DR_BORA; consumables with Billed = N, by ward; average deduction % by payer; claims submitted > 30 days after discharge; doctor payouts vs agreed revenue share. Quantify each in Rs and rank by impact.
14. FMCG-Pharma · distributor audit
Attached: Sales_Invoices, Batch_Stock, Retailer_Master, Product_Master, Scheme_Master, Collections, Sales_Returns. Test: sales after batch expiry; Sch H sales to retailers after DL_Valid_Upto; free qty vs scheme entitlement; average cash deposit lag by salesman (policy: 2 days); receipt number gaps; credit notes without Godown_GRN_No. Which salesman needs a surprise cash count, and why?
15. Claude Code · build your own tool
In this folder is <client export>.xlsx. Write a Python script that tests 100% of rows for: <test 1 with exact criteria>, <test 2>, <test 3>. Output an Excel report with a Summary sheet and one sheet per test. Explain every function in plain-English comments, run it, and show me the summary. Then convert the same tests into Excel formulas (no macros, Excel 2010 compatible).
16. DPDP · mask before upload
python tools/dpdp_mask.py mask datasets/03_Hospital_Lohit_Care.xlsx
# upload only outputs/*_MASKED.xlsx; keep *_KEY_DO_NOT_SHARE.csv on your machine
python tools/dpdp_mask.py unmask claude_findings.txt outputs/03_Hospital_Lohit_Care_KEY_DO_NOT_SHARE.csv