Confirmation Requests in an Audit: Why They Matter and How to Respond

What an external confirmation is

An external confirmation is audit evidence obtained as a direct written response to the auditor from a third party (the confirming party), on paper or by electronic or other medium. The key word is direct: the response must reach the auditor, not the audited company's accounting department.

Most often, account balances and their components are confirmed. But confirmations are also used to confirm the terms of agreements and transactions, and the absence of certain conditions, such as a side agreement with a customer.

Positive and negative requests

• Positive request — the confirming party responds to the auditor in every case: agreeing with the information, indicating a difference or providing the requested data.
• Blank positive request — the amount is not stated and the counterparty is asked to fill it in. This reduces the risk of a reply given without checking the records.
• Negative request — the confirming party responds only if it disagrees. Such confirmations are less persuasive, and the auditor may not use them as the sole substantive procedure unless all ISA 505 conditions are met at once: the risk of material misstatement is assessed as low and controls have been tested, the population consists of a large number of small homogeneous balances, a very low exception rate is expected, and there is no reason to believe recipients will disregard the request.

Why the auditor controls the process

ISA 505 requires the auditor to maintain control over confirmation requests. This means the auditor:

• determines the information to be confirmed;
• selects the appropriate confirming party — someone genuinely knowledgeable about the transactions, such as a specific bank officer;
• designs the requests, checks the addresses and includes return information so that responses go directly to the auditor;
• sends the requests and follow-up reminders where needed.
• The company may prepare letters on its letterhead signed by its director: many counterparties reply only to a request containing the client's authorisation. But sending the requests and receiving the responses remain with the auditor.

If management refuses to allow a request

A refusal by management is a limitation on audit evidence. The auditor must ask about the reasons and obtain evidence of their validity, assess the effect on the risks of material misstatement, including fraud risk, and perform alternative procedures.

A common and acceptable reason is an ongoing dispute or negotiation with the counterparty that a letter could harm. If the auditor concludes that the refusal is unreasonable, or cannot obtain evidence by other means, the auditor communicates this to those charged with governance and assesses the implications for the audit opinion.

Non-responses and exceptions

• For each non-response the auditor performs alternative procedures. For receivables: subsequent cash receipts, shipping documents and sales near period end; for payables: subsequent payments, correspondence from third parties and goods received notes.
• If a response to a positive request is necessary and alternative procedures cannot replace it, the absence of confirmation affects the audit opinion (ISA 705).
• The auditor investigates each exception to determine whether it indicates a misstatement. Some exceptions are explained by timing — for example, a payment in transit on 31 December — or by errors in the confirmation procedure itself.
• Fewer or more responses than expected may indicate a previously unidentified fraud risk factor.

Reliability of responses

Every response, paper or electronic, carries a risk of interception, alteration or fraud. Email responses are harder to authenticate, so the auditor may call the counterparty to check that it really sent the letter. Secure channels, electronic digital signatures and domain verification increase reliability.

An oral response on its own is not an external confirmation, because it is not a direct written response. If a response reaches the client's accounting department instead of the auditor, the auditor may ask the counterparty to send it again directly.

How to respond if the request is addressed to you

• Check that the letter is signed by your counterparty's director and contains its authorisation to disclose the data to the auditor.
• Reconcile the amount with your records as at the stated date, not today; in a blank request, state the balance yourself.
• If there is a difference, do not just say you disagree — attach a breakdown: documents not recorded by one side, payments in transit.
• Reply directly to the auditor at the return address given, not via the counterparty.
• Have the reply signed by an authorised person and give a contact for queries.
• If you are being audited yourself, reconcile balances with key counterparties in advance — the difference between a reconciliation and a confirmation is covered in our article on auditing accounts receivable.