CAG’s AI Audit Push: Can Technology Transform India’s Public Audit System?
The CAG-IIT Madras CADS initiative is building digital-audit capabilities (Image IIT madras)
By P. Sesh Kumar
The CAG-IIT Madras CADS initiative is building digital-audit capabilities, but its real test will be whether AI can strengthen scrutiny of government schemes, databases and policy implementation.
New Delhi, October 7, 2026 — On 27 August 2026 the Comptroller and Auditor General of India (CAG) and IIT Madras launched the Certification on Audit of Digital Systems (CADS), a three-tier credential delivered through SWAYAM Plus and billed by its makers as the first of its kind curated by a Supreme Audit Institution. The genuine analytical gains of artificial intelligence — population testing, cross-database linkage, machine-read institutional memory, continuous audit and the audit of algorithms themselves — are real, but they are most cheaply spent on beneficiary-level anomalies at the bottom of the delivery chain. The decisive test is whether the new capability carries the CAG back to all-India performance audits that interrogate the nodal Union Ministry’s design assumptions, fund releases and monitoring, at a time when Union audit reports tabled in Parliament have fallen steeply.
It opens with a question that sounds like a dare: how does one audit an algorithm, test an AI system for bias, or tell whether a digital platform is actually protecting citizens’ data? The answer offered by IIT Madras’s official handle, now doing a second lap of India’s professional timelines, is an acronym. CADS, the Certification on Audit of Digital Systems, is a joint venture of the Comptroller and Auditor General of India (CAG) and IIT Madras, built with the Institute’s technology foundation, IITM Pravartak Technologies Foundation, and delivered through the Ministry of Education’s SWAYAM Plus platform. The post reads like breaking news, but the event is six weeks old. CAG K. Sanjay Murthy launched the Foundation level on the Chennai campus on 27 August 2026, with the Institute’s Director, Prof. V. Kamakoti, beside him and the Additional Deputy CAG and Chief Technology Officer, Bijay Kumar Mohanty, setting out the rationale in the welcome address.
One clarification must be made at the threshold, because the rest of this argument hangs on it. CADS is neither an AI tool nor the memorandum of understanding. It is a training-and-credentialing pathway: six domains, three levels, online courses, a proctored test and a certificate. The tools themselves–data-led audit models, an in-house large language model (LLM), document-reading and pension-checking applications–sit in a parallel stream of work that the CAG has been building in fits and starts since 2015, and which the February 2025 memorandum with IIT Madras was designed to accelerate. The certificate trains the hands; the tools are the instruments; the audit reports are the music. The question this note presses is whether the nation will hear a different tune, or no tune or simply the old one played faster.
A Decade of Digital Ambition
The Indian Audit and Accounts Department (IAAD) did not discover data in 2026. In 2015, under CAG Shashi Kant Sharma, it framed a Big Data Management Policy on the premise that the digitisation of government had handed supreme audit institutions a vantage point few other agencies enjoyed: lawful access to vast data held across many departments, and the chance to read an auditee’s records alongside related data from elsewhere.
A Centre for Data Management and Analytics (CDMA) followed in June 2016 as the department’s nodal analytics body, and in September 2017 the Guidelines on Data Analytics codified the method, including the use of analytics to choose the units where substantive field checks would be conducted.
On 1 April 2023 the department moved its audit offices onto One IAAD One System (OIOS), an enterprise-wide workflow platform, and formally retired the paper file. There is however no document in public domain which proves the efficacy and extent of achievement of promised value addition from OIOS to CAG efforts.
The present CAG has pressed harder on the accelerator. On 24 February 2025 he signed two memoranda with IIT Madras: the first covering data governance and security, big-data and digital-infrastructure readiness, academic and research collaboration and advanced auditing practices; the second linking IIT Madras with the department’s environment-audit academy, iCED Jaipur, for AI-assisted environment and ESG audit.
His accompanying remark– that soon everything would sit on a digital trail–was the mission statement in miniature. Memoranda with IIM Ahmedabad, the geospatial agency BISAG-N and the National Institute of Urban Affairs followed within weeks. In September 2025 the department told the annual conference of State Finance Secretaries that a CAG-LLM was being built to put decades of institutional knowledge, including inspection reports, at auditors’ fingertips, alongside a “Connect” portal giving roughly ten lakh auditee entities a single digital window for answering audit queries. The 32nd Accountants General Conference in November 2025 showcased the indigenously built model and early AI deployments.
The most granular public picture comes from an unlikely place: an office order issued in February 2026 by a field audit office, circulating directions from the CAG’s demi-official letter of 28 November 2025. It names the applications now in play –AI for the supplementary audit of PSU accounts, an “AI-PARAS” system for pension authorisation cases, “CAG Parakh” for document and image analysis, AI to automate audit checks in direct taxes, and an “Audit AI Agent Foundry” spanning the audit lifecycle–directs data-led audit in works, establishment, social-sector schemes and receipts, and asks offices to nominate teams to give IIT Madras regular feedback on the LLM. That last line is the clearest public evidence one could find that IIT Madras is directly engaged with the CAG-LLM. It rests on a single document and should be read accordingly.
CADS, then, is the capacity-building wing of a larger edifice. Its immediate forerunner is a nine-month IIT Madras course in data analytics, AI, machine learning and cybersecurity for CAG officers, whose first graduates received their certificates at the same August ceremony and are, in the CAG’s account, already applying advanced analytics in field audit.
What CADS Is — and What It Is Not
Read on its own terms, the design is serious and, in places, thoughtful. There are six domains–Public Audit, Information Technology, Cybersecurity, Information Systems, Digital Public Platforms and Privacy, and Artificial Intelligence–each a standalone forty-five-hour course with its own certificate. Three tiers rise from Foundation (45 hours) to Proficient (90) and Expert (180). Assessment is weighted one-fifth on case studies and four-fifths on a proctored computer-based test at centres across India, with sandbox laboratories that simulate government and enterprise systems promised from the Proficient level. Certificates are valid for five years, but only three for AI and cybersecurity –a sensible acknowledgment of how quickly those fields go stale. Courses are free for the CAG’s own staff and cost Rs 2,000 per domain for everyone else; registration for the first batch opened on launch day and classes began on 7 September 2026.
Three caveats temper the press-release gloss. First, the “geography-neutral”, open-to-all promise is narrower in practice. At Foundation level, learners outside the CAG may enrol only in the Public Audit domain, the other five unlocking only after it is cleared; and the Proficient and Expert tiers are displayed as locked, with no announced dates. Second, the claim of being the first certification of its kind curated by a supreme audit institution (SAI) comes from the two partners and from the CAG officer who led its delivery.
There is no independent verification, and the safer formulation is that it is a first for an SAI as curator, since digital-audit credentials as such have long existed in the professional market. Third, and most consequential, the operative commitment–that CADS will, in time, become mandatory for officers auditing digital systems–carries no date. In the long history of Indian administrative reform, “in time” has buried more good intentions than any audit para.
Steel-Manning the Enterprise
Before the scepticism, the strongest case for what the CAG is doing deserves to be stated without condescension. The Indian state now runs on rails the auditor did not lay and, until recently, could not read. Direct benefit transfers ride on Aadhaar seeding and the Public Financial Management System (PFMS); indirect taxes on GSTN; welfare targeting increasingly on scoring rules and eligibility algorithms. An auditor who can only tick vouchers is auditing the shadow of a transaction, not the transaction. The CADS prospectus names the problem frankly–an AI-driven welfare platform, a national data exchange, a sprawling cloud estate–and admits that traditional audit training was never built to examine them.
The case is also one of arithmetic. The department’s output of once stinging Union audit reports has shrunk over the past decade (of which more below), and if the human base is thinner, the only way to cover more ground is to make each auditor see more. The CAG has already claimed early dividends: in September 2025 it told State Finance Secretaries that AI and machine-learning techniques had surfaced large numbers of fraudulent beneficiary cases across several States.
The international record is encouraging too. Brazil’s federal audit and control bodies have, since 2017, used a robot called Alice to read the daily torrent of federal tender notices and flag irregularities; the OECD credits Alice’s alerts, in the Comptroller-General’s deployment, with the suspension or cancellation of more than R$9.7 billion in bids between 2019 and 2022.
The US Government Accountability Office (GAO) published an AI accountability framework in 2021, organised around governance, data, performance and monitoring, which gave auditors a vocabulary for examining machines rather than merely using them. Seen in this light, CADS is not a vanity certificate but a workforce strategy, and IIT Madras--whose Centre for Responsible AI released an Indian-context bias-testing dataset, IndiCASA, in 2025–is a credible partner for the hardest part of it.
Smart Audits: A Critical Appraisal of iCISA’s AI-in-Audit Showcase
What AI Actually Adds — An Honest Ledger
So what, precisely, will these tools allow the CAG to do that it could not do before? Five things are genuinely new, and two of them are transformative.
The first is the death of the sample. Compliance audit has always selected units and vouchers because it could not read them all. Analytics allows the entire population of transactions–every payment under a scheme, every pension authorisation, every e-way bill — to be tested against the rules, with the field party reserved for the outliers. The 2017 guidelines already envisaged analytics guiding sample selection; AI pushes the frontier from selection to full coverage.
The second, and the first of the transformative pair, is linkage. The most damning irregularities hide in the seams between databases: the beneficiary dead in one register and alive in another, the contractor whose director is an official’s relative, the asset paid for in PFMS and absent from a satellite image. Entity resolution across PFMS, Aadhaar-seeded rolls, land records, GSTN and geospatial layers–the logic behind the BISAG-N memorandum–is where machine learning outruns any audit party. The CAG’s 2023 performance audit of Ayushman Bharat-PMJAY, which found lakhs of beneficiaries registered against dummy mobile numbers such as 9999999999, was a foretaste of what a linked, population-level look can expose.
The third is memory. A model trained on decades of inspection reports can tell an audit team in seconds that the same irregularity was flagged in the same district in 2014, 2018 and 2022 and never settled, turning the department’s archive from a graveyard of paras into an early-warning system.
The fourth is time. Continuous audit of the Alice type moves the auditor from the post-mortem to the operating theatre, catching a defective tender before the contract is signed; the Connect portal, if it works as advertised, compresses the slow minuet of audit query and reply.
The fifth, and the second transformative gain, is the audit of the algorithm itself: testing whether an eligibility model excludes the eligible, whether a scoring rule quietly embeds caste or gender bias, whether a platform’s data handling honours the Digital Personal Data Protection Act. This is not a faster version of old audit; it is a new object of audit, and the AI and privacy domains of CADS are aimed squarely at it.
Now the debit column, which the launch literature leaves blank. AI finds anomalies; it does not explain them. It cannot supply audit criteria, which come from statute, sanction and scheme guidelines; it cannot decide materiality; and it cannot by itself establish why a Ministry released a second instalment it knew would not be spent.
Generative models hallucinate, and an audit finding must meet an evidentiary standard that a fluent paraphrase does not. Data access remains hostage to the auditee: a CAG that cannot obtain a Ministry’s raw database has nothing to feed its models, and the department’s renaming of its data unit as an “AI Curation Unit” in its data-governance policy signals ambition, not access.
Finally, and most subtly, an LLM trained on the institution’s own inspection reports learns the institution’s habits, blind spots included. If the archive is dense with paras on vouchers and thin on policy design, the machine will be fluent in vouchers. Consistency, the virtue most often claimed for the CAG-LLM, can shade imperceptibly into conformity.
(This is first of the two-part series. This is an opinion piece. Views expressed are the author’s own.)
Follow The Raisina Hills on WhatsApp, Instagram, YouTube, Facebook, and LinkedIn
About The Author
