Continuous audit for clinics and hospitals: books that are ready before the CA asks

Most clinics meet their books twice a year: when GST or TDS is due and something does not add up, and when the chartered accountant asks for a year’s bills, bank statements and purchase invoices so the audit can start. Both times someone sits late with a folder of paper, and both times the questions are about something that happened months ago.

Continuous audit is the opposite habit. The checks an auditor would run at year end run every day, on every transaction, as it is recorded. A missing purchase invoice, a bill voided without a reason or a payment to a visiting doctor with no TDS shows up the day it happens, while the person who did it still remembers why. By year end the books are already current, and the audit is a review of a short list of exceptions.

This article is for clinic and hospital owners, administrators and the people who keep their accounts. It sets out what continuous audit means in practice, which checks matter most for a clinic in India, and how to start.

Why the year-end scramble keeps happening

A clinic’s money moves through five places, and in most clinics each one is recorded somewhere different:

1. Bills and receipts at the front desk: consultation fees, procedures, in-patient bills, advances.
2. Pharmacy and optical sales, often in separate software with its own day-end.
3. Purchases: medicines, consumables, implants and lenses, received against a supplier’s invoice.
4. Payroll: salaries, consultant fees, PF, ESI and professional tax.
5. Expenses and the bank: rent, utilities, petty cash, UPI and card settlements.

When each of these lives in its own register or spreadsheet, the books are assembled from them later, usually by the accountant, usually under a deadline. Every mismatch between the five is found at that point: a bank credit with no bill, a supplier invoice with no goods received, a salary paid in cash with no entry. Finding them months later is what makes the scramble.

What continuous audit means for a clinic

Three things, together:

• The books are written by the work, not after it. A bill raised at the front desk, a sale at the pharmacy, a goods received note, a salary run and an expense each post their own double-entry the moment they are saved. Nobody re-types a day’s collections into Tally at month end.
• Checks run on every entry, every day. Is the purchase invoice attached? Was the void approved? Does today’s cash in the drawer match the day’s cash bills? Was this entry made today for a date last month? Each check produces an exception list, not a report nobody reads.
• Nothing is quietly rewritten. A correction is a new entry or an approved change, never an overwrite. The edit log records who changed what and when, and it cannot be switched off.

The auditor’s work then moves from collecting and sampling to reviewing exceptions, which is cheaper for you and better for them.

Four rules that make this more than good practice

• Input tax credit depends on your supplier’s filing. Under the GST law you can claim credit on a purchase only if the supplier has reported the invoice and it appears in your GSTR-2B. A pharmacy or optical shop that matches its purchases to GSTR-2B every month finds the missing invoices while the supplier can still fix them. Found at year end, the credit is often lost. Our GSTR-2B reconciliation guide covers this in detail.
• Companies must keep an audit trail. Since 1 April 2023, Rule 3(1) of the Companies (Accounts) Rules has required every company that keeps its books electronically to use software that records an edit log of each change, with the date, and that cannot be disabled. The company’s auditor must report on whether it was kept. A clinic or hospital run as a private limited company is covered.
• TDS is due every month, not at year end. Fees to visiting consultants, payments to contractors and rent above the thresholds carry TDS that must be deposited by the 7th of the following month (30 April for March), with a statement every quarter. Under the Income-tax Act, 2025, in force since 1 April 2026, these deductions sit in one table in section 393 and the quarterly statements have new form numbers, but the rhythm is the same. A deduction missed until the audit costs interest for every month it was late.
• Late returns get harder to fix. A late GSTR-3B costs a late fee for every day and 18% a year interest on the tax. From the July 2025 tax period, the GST portal does not accept a return filed more than three years after its due date, and the liability auto-filled into GSTR-3B can no longer be edited there. A month that never closed keeps costing.

The compliance calendar for 2026-27 lists every recurring due date in one place.

The checks that matter most

Not every check needs to run every day. This is the rhythm we recommend for a clinic or a small hospital.

Every day, at each counter

• Cash counted in the drawer against the cash bills and refunds the system expects, signed off by the person closing.
• Every void, refund, discount above the clinic’s limit and edit to a paid bill approved by someone other than the person who asked, with a reason.
• Every entry made today for an earlier date listed for review. Late entry is often legitimate (a power cut, a paper day), but it should never be invisible.

Every week

• Visits with no bill, and bills with no visit.
• Goods received with no supplier invoice attached.
• Supplier bills falling due in the next two weeks.

Every month, before filing

• The bank and payment-gateway statements reconciled against the books, including UPI and card settlements that arrive net of fees.
• Purchases matched to GSTR-2B, with every missing or mismatched invoice followed up with the supplier.
• Statutory dues accrued and deposited: TDS, PF, ESI and GST, each against its challan.
• The month locked once it is filed, so nothing changes behind the return.

Every quarter and every year

• TDS statements filed and matched to deposits; advance tax paid.
• Fixed assets and depreciation, closing stock and a year-end checklist before the books go to the auditor.

What changes for your chartered accountant

A CA working from continuous books stops asking for folders. With your consent they can read the ledger, the reconciliations and the exception lists directly, for the period and the scope you allow. They spend their time on what needs judgement: classification, provisions, depreciation, tax positions. Two things matter when you give them access:

• Read-only, time-limited and revocable. Your CA should see the books, not patient records, and the access should end when the engagement does.
• A log both sides can read. Every time the firm opens the books, it should be recorded, and you should be able to see it.

Where clinics usually leak

From the clinics, pharmacies and optical shops we work with, the same gaps come up again and again:

• Bills voided at the counter with no reason, or edited after payment, so the day’s cash never matches.
• Pharmacy purchases with no invoice on file, so credit on GST is claimed without support, or not claimed at all.
• Consultant payouts with no TDS, because the payout was made from the drawer rather than through the books.
• Gateway settlements booked as one lump, so the bank never reconciles with the day’s bills.
• Paper days entered later with no mark, so nobody can tell which entries were made after the fact.

Each one is cheap to catch on the day and expensive to unpick in March.

How to start in 90 days

1. Month one: one book. Bring bills, pharmacy sales, purchases and expenses into one system that posts as it records. Close each counter every day.
2. Month two: the monthly close. Reconcile the bank and the gateway, match purchases to GSTR-2B, deposit statutory dues against the books, and lock the month after filing.
3. Month three: give your CA a seat. Grant read-only access to the books and agree which exceptions they review each month.

Where 92health fits

92health runs the clinical and the money side of a clinic, hospital, pharmacy or optical shop in one system, so the books are written by the day’s work:

• OP and in-patient bills, receipts, pharmacy and optical sales, goods received, expenses and payroll each post their own double-entry, with GST split into its legs;
• every till closes the day with cash counted against what was expected, and a closed day shows if anything in it changes later;
• voids, edits, discounts and stock write-offs go through approval, and every decision, including the ones approved automatically, sits in one log;
• entries made after the fact are recorded with who made them and when;
• bank and payment-gateway reconciliation, GSTR-2B matching, statutory dues against challans, period locks, depreciation and a year-end checklist;
• an edit log on the ledger that the application cannot switch off;
• read-only access for your CA firm, scoped and time-limited by you, with every access logged on both sides, and exports for Tally, GSTR-1 and GSTR-3B.

If you want to see your own month run this way, book a demo.

Sources

• Companies (Accounts) Rules, 2014, Rule 3(1) proviso (audit trail for financial years from 1 April 2023), and Companies Act, 2013, section 128(5), Ministry of Corporate Affairs.
• Companies (Audit and Auditors) Rules, 2014, Rule 11(g), Ministry of Corporate Affairs; ICAI guidance on audit trail requirements.
• Income-tax Act, 2025, sections 63 (tax audit) and 393 (tax deducted at source), and the CBDT transition FAQs, Income Tax Department.
• Central Goods and Services Tax Act, 2017, sections 16(2)(aa), 39 and 50, and the GSTN advisory on the three-year limit for filing returns.