What a CFO Should Expect From a Tax Audit Engagement: A Scope Checklist

Your tax auditor submits the draft Form 3CD just 15 days before the filing deadline, flagging a TDS shortfall, a GST turnover mismatch, and a missing MSME disclosure. None were identified at the engagement stage.

The engagement letter covered only the tax audit under Section 44AB, leaving these specific reviews outside its defined scope.

This highlights why a tax audit engagement requires clear scope, deliverables, and accountability. A loosely defined scope can lead to missed risks, last-minute delays, and disputes over responsibilities.

This post walks through the five phases of a tax audit for a large company and what you should expect from your auditor at each one. It also covers the deliverables to insist on and the warning signs that an engagement is heading for trouble.

The Tax Audit Engagement Lifecycle

For a large company, a tax audit under Section 44AB is a structured engagement that requires clear scope, reliable data, timely decisions, and documented sign-off. 

The CFO should understand what the auditor will examine, what the finance team must provide, and what deliverables are expected at each stage.

The engagement moves through five phases:

1. Pre-engagement scoping: Confirm applicability, scope, responsibilities, timelines, exclusions, and deliverables.
2. Documentation and data gathering: Assemble audited financial statements, tax computations, reconciliations, supporting records, and explanations for significant transactions.
3. Fieldwork and testing: The auditor examines books, supporting evidence, tax positions, and particulars reportable under the applicable tax audit requirements.
4. Reporting and findings: Review draft observations, resolve factual queries, document management responses, and address outstanding issues before finalisation.
5. Filing and sign-off: Complete the applicable audit report and statements, obtain the required professional authentication, and confirm electronic filing and closure.

Each phase should have an owner, a deadline, and a defined output. And each phase has scope decisions that the CFO should be involved in, not delegated entirely to the finance team or the auditor.

Phase 1: Pre-Engagement Scoping

Most tax audit delays and scope disputes begin before fieldwork starts. The CFO and auditor should agree upfront on what will be covered, who is responsible, what evidence is required, and when each deliverable is due.

The engagement letter should specify:

• Applicability and reporting form: Confirm the basis for the tax audit and whether Form 3CA or Form 3CB applies, along with Form 3CD for FY 2025–26 (AY 2026–27).
• Entities and locations: Identify the legal entity, relevant branches, plants, warehouses and GST registrations, clarifying whether any additional group-level work is included.
• Audit approach: Specify how the auditor will use the statutory audit and where additional testing or evidence will be required.
• Deliverables and exclusions: Confirm the statutory report, internal milestones and any additional outputs, such as a management letter or GST-to-tax turnover reconciliation. State explicitly whether transfer pricing documentation or other advisory work falls outside scope.
• Timeline and team: Agree on data handover, fieldwork, draft report, review meetings and final filing. Identify the signing partner and engagement team.
• Fees and scope changes: Document the fee, assumptions and approval process for additional work.

Appointment and risk planning

Confirm the auditor’s availability and compliance with applicable ICAI independence and professional requirements before appointment. 

A good auditor will want to know where last year’s issues sat before it starts testing. That means disallowances, assessment additions, open notices and any change in business, such as a new plant, a merger or a new overseas vendor. Agreeing these at the start means testing is aimed where risk actually is.

The CFO should approve the engagement scope rather than leave it entirely to the finance team. Statutory tax audit work does not automatically include a broader tax risk assessment or every GST and transfer pricing review.

At PKC, we begin with a scoping discussion involving the CFO and finance team, documenting the coverage, deliverables, exclusions, responsibilities and timeline. The scope is reviewed as the business and its compliance obligations evolve.

Phase 2: Documentation and Data Gathering

Once the scope is defined, the next phase is gathering the documentation the auditor needs. For a large enterprise, this is a series of reconciliations and supporting documents across multiple entities.

The auditor should issue a business-specific prepared-by-client (PBC) checklist covering:

• Books and financial statements: Final trial balance, general ledger, audited financial statements, notes to accounts, and mapping of ledger balances to relevant Form 3CD disclosures.
• Fixed assets: Asset register, additions and disposals, put-to-use dates, and depreciation schedules.
• TDS/TCS: Returns, challans, default reports, Forms 26AS and 16/16A where relevant, reconciled with the books and expenses.
• GST: GSTR-1, GSTR-3B and applicable annual returns for each GSTIN, reconciled with turnover in the financial statements and tax computation. Include the expenditure breakdown required under Clause 44 of Form 3CD.
• Statutory dues: Payment records and dates for liabilities covered by Section 43B, including applicable employer PF and ESI contributions.
• MSME payments: Supplier-wise outstanding balances, Udyam details where available, and payment dates to assess potential disallowances under Section 43B(h).
• Related parties: Transaction details and supporting agreements for relevant reporting, including Section 40A(2)(b) disclosures.
• Loans and deposits: Records of relevant receipts and repayments, including transactions requiring consideration under Sections 269SS and 269T.
• Inventory and prior-year matters: Quantitative inventory records where applicable, the previous tax audit report, assessment orders, and outstanding notices.

What the CFO Should Coordinate

Data gathering cannot just be a finance team task. Procurement must provide supplier and MSME information, HR must supply payroll-related statutory records, legal must provide relevant agreements, and IT must arrange appropriate access to accounting systems.

Each item should have a named owner, submission deadline, and review status. Records should also be reconciled before submission. For example, a difference between GST turnover and turnover in the financial statements needs a documented explanation, not just two separate figures.

PKC provides a documentation checklist organised by entity and function, helping teams coordinate submissions, resolve discrepancies early, and keep the audit on schedule.

Phase 3: Fieldwork and Testing

Fieldwork is where the auditor tests whether what your data says is true and correctly classified for tax purposes. The test is income-tax law, not accounting standards, and the two often differ.

For a large company, testing should focus on the clauses that produce most disallowances and assessment questions:

• Disallowable expenses (Clause 21): Payments attracting disallowances, including applicable TDS defaults, specified related-party payments, and cash payments exceeding prescribed limits.
• Statutory liabilities (Clause 26): Payments covered by Section 43B, checked against actual payment dates and applicable deadlines.
• MSME dues (Clause 22): Relevant outstanding amounts and interest disclosures, including potential disallowances under Section 43B(h).
• TDS/TCS (Clause 34): Deduction rates, deposit dates, returns, and defaults.
• GST and expenditure (Clause 44): The required expenditure breakdown by GST registration status and reconciliation with relevant records.
• Tax adjustments (Clause 13): Income Computation and Disclosure Standards (ICDS) adjustments, where applicable.
• Depreciation and capital expenditure: Asset records, put-to-use dates, depreciation claims, and the capital-versus-revenue classification of significant expenditure.
• Profitability trends (Clause 40): GP and NP ratio movements compared with the preceding year, including explanations for material variations.

The auditor may use sampling or examine entire transaction populations, depending on the risk, volume, and nature of the records. The approach should be clear for each significant area.

What the CFO Should Monitor

Fieldwork should generate interim findings, tracked through a weekly issue log recording potential amounts, relevant reporting clauses, required evidence, responsible owners, and resolution deadlines.

The CFO should ensure timely responses, access to branch-level information, and early escalation of material findings. A decline in GP or NP ratios alone does not justify rejecting the books under Section 145(3); the circumstances and supporting evidence must be considered.

 If you have plants or branches in several states, confirm which locations the team will visit or test remotely. Branch-level TDS and GST data is a common source of late-stage mismatches.

Phase 4: Reporting and Findings

The reporting phase produces the draft audit report, the observations, and the management responses. This is the phase where the auditor’s findings are formalised.

For a large company, the reporting phase should focus on the following:

• Form 3CA/3CB: The audit report confirming the audit status of the accounts and, where applicable, whether the auditor obtained the necessary information and explanations.
• Form 3CD: Clause-wise disclosures covering accounting methods, depreciation, disallowances, statutory liabilities, TDS/TCS, MSME dues, GST-related expenditure, related-party transactions, and other prescribed matters.
• Draft report review: The CFO should receive the draft and supporting schedules well before filing. A 7–10 working-day review window is practical for large companies. Verify reconciliations, tax adjustments, and clauses marked “not applicable.”
• Qualifications and observations: Discuss missing information, unverifiable claims, and compliance issues before finalisation, providing supporting evidence wherever possible.
• Management representation letter: Review all representations carefully to ensure their accuracy before signing.
• Management responses: Document the basis and evidence for disputed findings, or corrective actions and timelines for accepted findings. Record differences in legal interpretation and reflect the adopted position appropriately in the return.

The CFO’s review:

The CFO should review the draft report before it is finalised. Specifically:

• Are the observations accurate? If the auditor has raised a TDS default, is the amount correct? Is the period correct?
• Are the management responses appropriate? A response that disputes the observation should be supported by evidence. A response that accepts the observation should include a remedial plan.
• Are there observations that should be escalated to the board? Material findings like significant tax exposure, recurring compliance failures, or observations that could affect the company’s tax position should be disclosed to the audit committee or board.

The most common error is accepting the draft report without review. The auditor’s observations are based on the data provided. If the data was incomplete or incorrect, the observations may be inaccurate. The CFO’s review is a quality check.

PKC provides a draft report with observations categorised by risk level. The draft is discussed with the CFO and finance team before finalisation, and management responses are incorporated. Material observations and unresolved issues are flagged for appropriate board or audit committee attention.

Phase 5: Filing and Sign-Off

Filing is the final stage of the tax audit process, but it requires coordination between the auditor and the company. 

The auditor uploads the tax audit report electronically, and the company must approve it on the income-tax e-filing portal. The CFO should ensure that the report is accepted and that the income-tax return is filed within the applicable statutory deadline.

For a large company, the filing phase should focus on:

• Electronic filing: The auditor uploads Form 3CA or 3CB, along with Form 3CD, to the income-tax portal. The company must then accept the report through its authorised account to complete the process.
• UDIN generation: The auditor generates a Unique Document Identification Number (UDIN) in accordance with applicable ICAI requirements and links it to the report.
• Assessee approval: The company should monitor the portal and ensure prompt acceptance by authorised personnel.
• Income-tax return filing: Before filing, the tax and finance teams should incorporate Form 3CD adjustments into the tax computation and reconcile turnover and TDS figures with Form 26AS, AIS, and the books. Retain the final report and supporting schedules for future assessments.
• Filing deadlines: Confirm the applicable deadlines against the latest statutory provisions and CBDT notifications, including any extensions relevant to the company.

What the CFO should ensure

The CFO should confirm that the auditor has filed the report electronically, linked the UDIN, and that the company has accepted it on the portal. Complete filing at least 2-3 working days before the deadline to allow for technical issues and pending approvals.

Before filing the return, verify that Form 3CD adjustments are reflected in the tax computation, turnover and TDS figures reconcile with Form 26AS and AIS, and all audit records are retained.

Conclude with a review of recurring errors, control gaps, unresolved issues, and corrective actions. Revise a filed report only where permitted and supported by valid reasons.

Engagement Deliverables You Should Insist On

The statutory deliverable is Form 3CA/3CB with Form 3CD. But a well-scoped tax audit engagement should deliver more. For a large enterprise, we recommend insisting on the following deliverables:

• Engagement letter with defined scope: Specifying applicability basis, entities, locations, deliverables, exclusions, timeline, and fees
• Documentation checklist: Structured by function and entity, with clear responsibility for each item
• Business-specific PBC list: With item owners and dates, issued at least eight weeks before the due date.
• Query log: A record of all queries raised during fieldwork, responses provided, and conclusions reached
• Draft report with observations: Categorised by risk level, with management responses
• Management letter: A summary of material observations, recommendations, and remedial actions
• GP/NP ratio analysis: An explanation for any material variation from the previous year
• Reconciliation schedules: GST turnover with income tax turnover, TDS with expenses, and MSME dues with vendor records
• Filing confirmation: Confirmation of electronic filing, UDIN, and ITR filing
• Post-audit debrief: A meeting with the CFO and finance team to discuss findings, lessons learned, and improvements for the next year

The auditor’s working papers belong to the auditor, and you should not expect to receive them. You are entitled to clear, written explanations of every finding that affects your tax position.

At PKC Management Consulting, our tax audit deliverables include all of the above, with the management letter and post-audit debrief as standard components. The debrief is used to identify process improvements for the next year’s engagement.

Red Flags During a Tax Audit Engagement

A tax audit engagement can drift off course. The following red flags indicate that the engagement is not delivering what it should:

• No engagement letter, or a one-page generic one. If scope, entities and milestones are not written down, they will be argued about in October.
• A generic PBC list that ignores your GSTINs, plants and industry suggests the team has not studied your business.
• Fieldwork starting less than a month before the due date. For a company with several locations, that leaves no time to clear findings.
• You are asked to fill in Form 3CD yourself. Your team supplies data. The auditor tests it and is responsible for the report. If your team is drafting clauses that are then signed with little testing, the report carries risk for both sides.
• The partner appears only on signing day. Judgment calls on qualifications and disallowances need the signing partner earlier than that.
• No issue log, and findings arrive all at once at the end. This leaves only the choice between reporting and delaying.
• The signing partner is near the 60-audit cap. Capacity pressure shows up as late drafts and thin testing.
• No reconciliation with GST, Form 26AS or the AIS. These are the first places a scrutiny notice looks.
• Pressure to leave a clause blank or mark it “not applicable” without support. This pressure can come from either side. A clean-looking report that later turns out to be incomplete is worse than an honest disclosure.
• Independence conflicts. The same person maintaining your books, running internal audit and signing the tax audit is not allowed and weakens the report.
• If the auditor is unresponsive during fieldwork, the engagement is not being managed. The CFO should escalate.
• No discussion of Form 26. An auditor who has not raised next year’s change by now is unlikely to be ready for it.

A common objection at this point is that tax audit is a routine compliance item, and the statutory auditor will handle it as usual. For a smaller business that may be true.

But at ₹100 crore and above, with multiple entities, multiple locations, and complex transactions, the tax audit is also a risk management exercise. 

The auditor’s findings can affect the company’s tax position for years. The observations can trigger scrutiny. The GP/NP ratio analysis can attract notices. 

Your internal finance team knows the business. What they may not have is the specialised knowledge of the tax audit clauses, the experience with scrutiny triggers, or the capacity to coordinate across functions. A dedicated tax audit firm brings this expertise.

Engaging a specialised tax audit firm is not a reflection on your internal team’s competence. It is a recognition that the tax audit at this scale requires a different approach.

PKC’s Tax Audit Methodology

PKC’s approach to tax audit support starts from one principle: the auditor prepares the report, but the business owns the data behind it.

Most of the work therefore goes into getting that data right before the auditor starts testing.

At PKC, we recommend starting two to three months before the due date rather than in the final weeks. The work covers:

• reconciling the books with GST returns and Form 26AS;
• preparing data clause by clause, with particular attention to clauses 21, 26, 34 and 44, where most disallowances arise;
• coordinating with the tax auditor through e-filing.

That timing leaves room to fix data gaps, answer auditor queries and avoid last-minute reconciliation pressure. It also reduces the risk of a qualified report or a scope exclusion caused by missing information. For multi-entity groups, the same discipline applies entity by entity, with a consolidated view before filing.

For clients on an ongoing engagement, monitoring runs through the year, so issues such as overdue MSME payments or TDS gaps are caught in the quarter they occur. Otherwise they surface only at audit.

The work draws on PKC’s tax advisory and audit teams. Our tax practice is backed by more than 30 years of direct and indirect tax experience. We have worked with businesses since 1988 and today have more than 200 professionals serving over 1,500 clients across manufacturing, retail, healthcare, IT and real estate.

If you are the CFO of a large enterprise and want to ensure your tax audit engagement is scoped correctly, delivered on time, and useful for the board and the tax department, contact PKC’s tax audit team. 

Discuss Your Tax Audit Requirements

We can help you define the scope, coordinate the documentation, and manage the engagement through to filing.

FAQs

What is the scope of a tax audit engagement under Section 44AB?

The scope of a tax audit engagement is defined by Section 44AB of the Income Tax Act and the engagement letter. It includes examination of the books of account, verification of compliance with tax provisions (TDS, GST, depreciation, disallowances), and reporting in Form 3CA/3CB with Form 3CD. The engagement letter should specify the applicability basis, entities covered, locations, deliverables, exclusions, and timeline.

What are the deliverables of a tax audit engagement?

The statutory deliverables are Form 3CA/3CB (audit report) and Form 3CD (statement of particulars). A well-scoped engagement should also deliver an engagement letter, documentation checklist, query log, draft report with observations, management letter, GP/NP ratio analysis, reconciliation schedules, filing confirmation, and a post-audit debrief.

What are the red flags during a tax audit engagement?

Red flags include scope creep without documentation, persistent data gaps, observations raised after the draft report, auditor unresponsiveness, management responses without evidence, filing delays without communication, and no post-audit debrief. These indicate the engagement is not being managed effectively.

How does PKC approach tax audit engagements for large enterprises?

PKC’s tax audit methodology is structured around five phases: pre-engagement scoping, documentation and data gathering, fieldwork and testing, reporting and findings, and filing and sign-off. The engagement begins with a scoping discussion with the CFO, includes a structured documentation checklist, and ends with a post-audit debrief. Material findings are escalated during fieldwork, not after the draft report.

What should a CFO look for in a tax audit firm?

A CFO should look for a firm with depth of experience in tax audit, risk-awareness in assessing compliance gaps, documentation discipline, a group-level perspective, and integration with the company’s overall tax compliance. The firm should be able to explain its methodology, escalate material findings early, and provide a debrief that helps the finance team improve for the next year.