ICAI Exposure Draft (July 2026) on Tax Audit Guidance Note

ICAI Exposure Draft (9 July 2026) on Tax Audit Guidance Note

The ICAI Direct Taxes Committee has released an exposure draft proposing revisions to the Guidance Note on Tax Audit under Section 44AB of the Income Tax Act, 1961. Comments were invited up to 25 July 2026. Importantly, this is expected to be the last Guidance Note under the 1961 Act, as the Income Tax Act, 2025, has come into force from 1 April 2026, shifting tax audit provisions to Section 63 of the new law.

Key Changes at a Glance

Area	What Has Changed?	Impact on CAs & Tax Auditors
Transition to IT Act, 2025	Section 44AB replaced by Section 63	Auditors must prepare for new law-based reporting
VDA & Carbon Credits	Included in “gross receipts from business”	Crypto and carbon-credit dealers may cross audit thresholds more easily
DPDP Act Compliance	New data privacy expectations	Stronger controls over client data required
Audit Assignment Counting	Branches treated as one assignment	Easier assignment-count computation
Management Representation Letter	Format revised	Firms should adopt updated MRL templates
Form 3CD Reporting	Enhanced scrutiny of disclosures	More robust audit documentation needed

Transition to the Income Tax Act, 2025

• What the Exposure Draft Says This is the final Guidance Note under the Income Tax Act, 1961. Tax audits going forward will be governed by Section 63 of the Income Tax Act, 2025. And Section 536 for transition provisions.
• Practical Impact: For most taxpayers, audit concepts remain broadly similar; existing audit thresholds largely continue. And reporting references must gradually shift from updating tax audit manuals to training audit teams on the new act numbering. And revise internal checklists and templates.

Expansion of “Gross Receipts in Business”

Major Change: The draft specifically includes Virtual Digital Assets (VDAs) and Carbon Credits within gross business receipts where the taxpayer deals in such assets. For Example

Business Activity	Included in Gross Receipts?
Crypto trading	Yes
NFT trading	Yes
Carbon credit trading	Yes
Tokenized carbon credits	Yes

Clarification Given

The following are not treated as business gross receipts for audit-threshold purposes: Recovery of old bad debts already written off, Remission of liability under Section 41 and Capital receipts from sale of fixed assets not credited to P&L

Practical Impact: Businesses trading in crypto assets, NFTs, and carbon credits may cross audit limits sooner due to inclusion in turnover calculations.

DPDP Act, 2023 Compliance Expectations:

New Focus Area Tax auditors routinely handle PAN details, Aadhaar details, salary information, bank account information, and personal financial records. The draft emphasizes stronger compliance with the:

Digital Personal Data Protection (DPDP) Act, 2023.

• Expected Controls Need-to-know access, password-protected systems, secure cloud storage, data retention policies and confidentiality controls.
• Engagement Letters: Firms should update engagement letters to include data-processing clauses and privacy obligations. Confidentiality provisions, Data breach responsibilities
• Practical Impact: Tax audit quality now includes not just tax compliance but also data-governance compliance.

Tax Audit Assignment Counting

• Clarification Issued: Branch Audits If one auditor audits one tax audit assignment, separate UDINs may be generated.
• Revised Tax Audit Where Auditor A conducted the original audit. And Auditor B performs a revised tax audit. The revised audit will count towards Auditor B’s assignment limit.
• Practical Impact of it More clarity in assignment counting, better compliance with ceiling limits, and reduced ambiguity for multi-branch entities.

Revised Management Representation Letter (MRL)

The sample MRL has been updated and aligned with: Auditing and Assurance Standards Board (AASB) format. The purpose of the MRL is to be revised. The MRL seeks management confirmation regarding the completeness of records, tax disclosures, related-party information, VDA disclosures, and carbon-credit transactions. And compliance representations. The v=basic practical impact of MRL is that firms should replace older MRL formats and use the revised ICAI-compliant version.

Enhanced Form 3CD Reporting Expectations:

The draft expects greater scrutiny in areas such as:

Reporting Area	Auditor Focus
VDA Turnover	Verify inclusion in business receipts
Carbon Credit Turnover	Proper classification
GST RCM Liability	Section 43B reporting
Clause 17	Accuracy of disclosures
Clause 35(a)	Stock-related reporting
Clause 38	Tax compliance checks

The guidance also incorporates observations from the Tax Audit Quality Review Board (TAQRB) to reduce recurring reporting errors.

Compliance Implications for Firms

• Immediate (Short-Term) Tax Audit Firms Should Update engagement letters, Revise Form 3CD checklists, Incorporate VDA and carbon-credit verification procedures, Strengthen DPDP compliance processes. Adopt the revised management representation letter format.
• Medium-Term: Firms Should Prepare For Full migration to the Income Tax Act, 2025, Section 63-based tax audit reporting and enhanced audit quality controls. And Better documentation standards for VDAs, Carbon Credits, GST reporting and Data governance

1. VDA and carbon-credit receipts now receive explicit recognition in turnover computations.
2. Tax auditors must adopt DPDP-compliant data-handling practices.
3. Assignment-counting rules have been clarified.
4. A revised Management Representation Letter must be used.
5. Form 3CD reporting will involve greater scrutiny and documentation.

In short, the draft pushes tax audit practice towards a more technology-driven, documentation-intensive, and compliance-focused framework, particularly for emerging areas such as crypto assets, carbon credits, and digital-business transactions.

tax audits are becoming increasingly documentation-intensive, technology-enabled, and compliance-focused, particularly in emerging sectors such as cryptocurrency, NFTs, tokenized assets, carbon credits, and digital businesses. Firms that adapt early will be better positioned to meet future regulatory expectations and audit-quality standards.