CAG To Hire Private Firms For Audits, Experts Warn of Conflicts And Risks

The Comptroller and Auditor General (CAG) of India’s decision to allow Chartered Accountant (CA) firms to assist in auditing central autonomous bodies for the first time ever has sparked immediate controversy.

In the announcement which came last week, the move was described by officials as an effort to expand the CAG's audit reach and improve overall coverage. It marks the first public initiative where external professional firms will directly participate in pubic sector audit activities under the supervision of CAG officials.

Concerns were formally raised by S Venkatesa, a member of parliament (MP) from Madurai, Tamil Nadu, who described the CAG’s decision as "dangerous" and "unconstitutional," arguing it could compromise the CAG’s constitutional mandate and risk allowing "confidential and sensitive information" into private hands.

Established under Articles 148 and 149 of the Indian Constitution, the CAG is a constitutional authority mandated to audit all receipts and expenditures of both central and state governments. The institution's primary role, as defined by the Constitution and subsequent Supreme Court rulings, is to uphold transparency, accountability, and fiscal discipline by auditing government bodies and reporting its findings directly to Parliament and state legislatures.

The MP warned of the risks in a letter to the President of India, urging her to intervene and direct the withdrawal of the CAG’s tender, and he isn't alone in scrutinising this move.

Aditya Bhattacharya, Partner at King Stubb & Kasiva, Advocates and Attorneys, shares these constitutional concerns. "The CAG's decision to empanel private CA firms for auditing central autonomous bodies under Article 149 raises legal concerns," he told The Core.

"This could set a precedent for outsourcing sovereign audit functions, necessitating new legal safeguards to ensure accountability and transparency. The involvement of private firms might be seen as a dilution of this constitutional mandate, potentially challenging the CAG's autonomy and the integrity of the audit process."

Too Big To Audit Alone, Or Is It?

The CAG has justified the move as a practical response to growing audit demands. Over the years, several central autonomous bodies have expanded significantly in both scale and budget. For example, the All India Institute of Medical Sciences (AIIMS) now spends around Rs 6,000 crore annually. Deputy CAG Anand Mohan Bajaj told PTI that while the CAG has been auditing these bodies annually, “a need has been felt to augment our audit effort with expert professionals wherever required.”

According to multiple reports, the plan is to initially target around 350 large central autonomous bodies — including universities, research institutes, and statutory boards — which have traditionally been audited exclusively by the CAG’s own staff. Now, for the first time, private auditors will be directly integrated into CAG-led audit teams to examine these government-funded institutions

However, officials said that the private CA firms will operate under the supervision of CAG officers, with the audit findings remaining the CAG’s responsibility.

The intent, according to CA Manish Kalra, appears to be pragmatic. “There are 350 central autonomous bodies, and the number is around 1,000 at the state level. Auditing 350 firms is a time-consuming task,” he told The Core.

Kalra estimates that auditing a single body like AIIMS “will involve at least 50 people and continuous effort of two months.” He added that the CAG is already under-resourced, and attracting skilled professionals remains a challenge, as private CAs can earn significantly more in the private sector than by working in government roles.

The Institute of Chartered Accountants of India (ICAI) has publicly supported the CAG’s move, calling it a welcome step. The institute clarified that the involvement of private firms is not a delegation of constitutional responsibilities, but rather a measure to enhance audit capacity and improve the overall efficiency of public audits.

A Constitutional Innovation, Or Overreach?

However, not everyone — including experienced lawyers and chartered accountants — sees this as a positive shift. Many view it as a move fraught with risks, including ethical concerns, potential conflicts of interest, data security vulnerabilities, and, most significantly, constitutional implications.

A senior chartered accountant with experience auditing both public and private sector entities, who requested anonymity due to the sensitivity of the issue, pointed out that while the appointment of auditors in government-owned companies is governed by statutory frameworks like the Companies Act, “when it comes to regulators (like TRAI and IRDAI) or ministries, the legal basis for appointing private firms to audit them is unclear.”

“The CAG may have the authority to appoint external experts under the CAG Act, but this kind of direct participation in its core audit teams is without precedent,” added the accountant.

He also raised concerns about data confidentiality. Confidentiality is always part of the audit engagement. You’re not supposed to disclose information to any third party, and that’s a given,” he said. “But in sensitive government audits, the onus of maintaining confidentiality rests entirely on the practising chartered accountant.”

From a constitutional standpoint, the move also enters uncertain terrain.

“Article 149 of the Constitution neither expressly provides for such third-party engagements nor prohibits it. What it does do is to outline the functions and powers of the CAG. Given this backdrop, the constitutional status of the CAG's recent move is in the gray,” said Dolashree Mysoor, associate professor at the School of Law, RV University, Bangalore.

Mysoor also explained that while some statutory institutions, such as the National Legal Services Authority, do routinely empanel private professionals for public functions, the CAG’s position is markedly different. Because the CAG is an independent constitutional authority, any move to share its audit responsibilities with private firms must be examined more carefully under the law, she added.

In this context, Mysoor said, the CAG’s decision could either be interpreted as a permissible form of delegation or, conversely, as exceeding its mandate altogether. “In constitutional interpretation,” she noted, “the silence of the Constitution can’t be read as automatic permission.”

However, some legal experts have warned that the CAG’s decision, while legally permissible, could still raise serious constitutional concerns. R. Sudhinder, Senior Partner at Argus Partners, cautioned that even if the Constitution does not explicitly prohibit such a move, it risks undermining the very values the CAG was designed to uphold.

“The whole idea is that it should be an independent body, which does not report or does not have to report to the government,” Sudhinder told The Core.

“That independence is the core of creating it as a constitutional body under the Constitution.”

He added that if someone were to file a public interest litigation (PIL), especially over audits of regulators or sensitive public bodies, the courts might be compelled to examine the constitutional validity of the move. While the courts may not strike it down outright, they could still ask the CAG to explain why private auditors were granted access to potentially sensitive data.

“When a person or an audit company does an audit, they can ask for all documents. They have access to everything,” he said. “You can’t refuse. And tomorrow, somebody who does audit for TRAI will do it for a private company; they will then have an unethical advantage.”

Conflicts of Interest, Weak Checks, Real Risks

One of the key concerns raised by the senior chartered accountant who spoke to The Core anonymously, is the potential for conflicts of interest. According to the accountant, while the ICAI’s code of ethics bars a CA firm from auditing and consulting for the same entity, in practice, firms often bypass this restriction by routing consultancy work through affiliates or sister firms.

This, the accountant said, effectively defeats the purpose of the rule. He also pointed out that disclosure of such engagements is voluntary, and there is no formal mechanism to verify these relationships. “The risk of conflict remains; you can’t eliminate it completely,” he said. “It’s disclosure based, and easy to route around.”

Sudhinder of Argus Partners also drew a clear line between what kinds of audits could reasonably be supported by private firms and what must remain solely under the CAG’s purview. According to him, audits of commercial public sector undertakings (PSUs), profit-oriented government companies, or specific technical assignments such as forensic analysis in fraud cases, may justify limited private sector participation.

However, he cautioned against involving private firms in audits of sensitive institutions like regulators (such as TRAI or UIDAI), defence agencies, or research bodies, where national security, procurement, or regulatory data is at stake.

“But private firms should not be given carte blanche access to regulatory or high-risk bodies like TRAI, UIDAI, defence agencies or research institutions. Audit firms involved with one party (say, TRAI) could later audit a private company (say, Airtel), that’s a huge competitive advantage and a direct conflict.”

India’s Turn To Outsource, But On What Terms?

That being said, globally, India’s move is not without precedent. In several countries, supreme audit institutions have turned to private firms to supplement in-house capacity, particularly for technical or high-volume assignments.

The United States employs a similar hybrid model. The Government Accountability Office (GAO), which reports to Congress, largely focuses on performance audits using internal staff. For financial audits of federal departments, however, the Inspector General (IG) of each agency is authorised under the Chief Financial Officers (CFO) Act to hire independent public accounting firms.

These international examples show that while outsourcing audit functions is not inherently unusual, it is always accompanied by clear legal authorisation, detailed regulatory safeguards, and well-defined accountability mechanisms — elements that legal experts say are still missing or unclear in the CAG’s current framework.