CAG and IIT Madras Launch a Certification for Auditing AI and Digital Public Infrastructure

🗞️ Why in News On August 27, 2026, the Comptroller and Auditor General of India, K. Sanjay Murthy, launched the Foundation level of the Certification on Audit of Digital Systems (CADS) at the IIT Madras campus, alongside Director Prof. V. Kamakoti. The programme is delivered through SWAYAM Plus and is designed to build capacity for auditing Digital Public Infrastructure, artificial intelligence and enterprise platforms. The CAG stated that CADS “will, in time, be a mandatory requirement for officers auditing digital systems.”

What CADS Is

The syllabus covers Public Audit, Information Technology, Cybersecurity, Information Systems, Digital Platforms and Privacy, and Artificial Intelligence.

Why This Matters More Than a Training Programme Usually Would

The significance is not the course. It is what the course concedes about the nature of the audit object.

The traditional audit question no longer reaches the decision

Public audit has classically asked three questions: was the money spent as sanctioned (regularity), was it spent economically and efficiently (propriety and performance), and are the accounts accurate (financial). Each assumes a human decision recorded in a file, which an auditor can retrieve, read and test against a rule.

In a Digital Public Infrastructure system, that assumption fails.

When an entitlement is granted or refused by a system rather than by an officer, the decision does not exist in a file. It exists in code, configuration, training data and a threshold. There is no note on which to record a dissent, and often no individual who made the decision at all.

That last row is the crux. A human error affects the file in front of the officer. A wrong rule in a system applies to every transaction it touches, uniformly and invisibly, until someone tests for it.

The constitutional argument

The CAG’s mandate under Article 148 and the CAG’s (Duties, Powers and Conditions of Service) Act, 1971 extends to the receipts and expenditure of the Union and the States. Increasingly, that expenditure flows through DBT, Aadhaar-linked delivery and algorithmically assisted assessment.

An auditor who cannot audit an algorithm cannot discharge that mandate over the programmes where most welfare money now moves. The capacity gap is therefore not administrative. It is constitutional, and the certification is an acknowledgement of it.

Critical Analysis

The honest question is whether training is the right instrument. Auditing an algorithm requires two things: auditors who understand systems, and auditing standards that define what a compliant system is. The certification supplies the first. It does not supply the second.

Without standards, a trained auditor arriving at a DPI platform still faces an undefined question: what would a passing grade look like? Is a 2 per cent exclusion error acceptable? Must a model be explainable, or only accurate? Who is accountable when a threshold set three years ago now excludes a category nobody anticipated? Financial audit has decades of settled standards behind it. Algorithmic audit has almost none.

Access is the second problem. An auditor cannot examine what an auditor cannot see. Auditing a system requires access to source code, configuration history, training data and logs, sometimes held by private vendors under contracts with confidentiality and intellectual property clauses. Whether the CAG’s power to call for records extends to a vendor’s model weights has not been tested. That is a question about the terms of the procurement contract as much as about audit law.

The openness of the course cuts both ways. Opening CADS to undergraduates and professionals rather than restricting it to audit officers builds a wider talent pool and a shared professional vocabulary, which is good. It also means the certification is a general credential rather than an internal capability build, and its value will depend on whether it becomes genuinely mandatory as the CAG suggests, or remains an option.

The strongest reading: this is the audit institution responding to a change in the nature of the state faster than most institutions have. It is a first step, and the standards and access questions are the second and third.

UPSC Relevance

GS Paper 2: Constitutional bodies, their powers, functions and responsibilities; accountability and institutional mechanisms; e-governance applications, models, successes, limitations and potential.

GS Paper 3: Awareness in the fields of IT and computers; cybersecurity; the role of technology in governance.

Prelims angle: Articles 148 to 151 on the CAG, the current CAG, and the DPI vocabulary.

Mains angle: “As governance moves into algorithmic systems, the auditable object changes from a decision to a system. Examine the implications for the office of the Comptroller and Auditor General.” This is a genuinely fresh framing and will read as original.

Ethics and interview angle: if an algorithm wrongly denies an entitlement to a hundred thousand people, who is accountable, and what does accountability mean when no individual made the decision?

📌 Facts Corner — Knowledgepedia

The launch:

• 27 August 2026, at IIT Madras. CAG K. Sanjay Murthy; IIT Madras Director Prof. V. Kamakoti.
• Certification on Audit of Digital Systems (CADS), delivered via SWAYAM Plus, designed jointly by CAG, IIT Madras and IITM Pravartak.
• Three tiers: Foundation, Proficient, Expert. The Foundation level was launched.
• Four-month online programme with in-person proctored assessments; open to undergraduates and professionals.
• Aligned with NEP 2020 and the National Credit Framework (NCrF).
• The CAG stated it “will, in time, be a mandatory requirement for officers auditing digital systems.”

The CAG:

• Article 148: the Comptroller and Auditor General of India. Appointed by the President; removable in the same manner and on the same grounds as a Supreme Court judge.
• Tenure: six years or until the age of 65, whichever is earlier.
• Article 149: duties and powers. Article 150: form of accounts of the Union and States, prescribed by the President on the CAG’s advice. Article 151: audit reports submitted to the President (Union) or Governor (State), for laying before the legislature.
• Governed by the CAG’s (Duties, Powers and Conditions of Service) Act, 1971.
• Salary and expenses are charged on the Consolidated Fund of India, so they are not subject to vote.
• The CAG is ineligible for further office under the Government of India or of any State after ceasing to hold office.
• Described by Dr B.R. Ambedkar as the most important officer under the Constitution.
• CAG reports are examined by the Public Accounts Committee, the Committee on Public Undertakings and the Estimates Committee.
• India’s CAG participates in INTOSAI, the International Organisation of Supreme Audit Institutions, and has held external audit assignments for UN bodies.

Digital governance vocabulary:

• Digital Public Infrastructure (DPI): the layered public digital rails, commonly summarised as identity (Aadhaar), payments (UPI) and data exchange (DEPA / Account Aggregator).
• India Stack is the term for this set of open APIs and digital public goods.
• SWAYAM is the Ministry of Education’s MOOC platform; SWAYAM Plus is its industry and employability-focused extension.
• IITM Pravartak is the Technology Innovation Hub at IIT Madras under the National Mission on Interdisciplinary Cyber-Physical Systems (NM-ICPS), funded by the Department of Science and Technology.
• The National Credit Framework (NCrF) enables credit accumulation and transfer across general, vocational and skill education, under NEP 2020.

Watch the trap:

• The CAG is removable in the same manner as a Supreme Court judge, but is not appointed by a collegium. Appointment is by the President.
• The CAG audits but does not control expenditure, despite the word “Comptroller” in the title. Unlike the British Comptroller and Auditor General, India’s CAG has no power to authorise the issue of money from the Consolidated Fund.
• The CAG audits Government companies under the Companies Act, and audits the accounts of bodies substantially financed from government revenues, but is not the auditor of every public-sector entity in the same manner.

Source: CAG and IIT Madras Launch a Certification for Auditing AI and Digital Public Infrastructure — Ujiyari.com | Free UPSC & State PCS Current Affairs