Audit Confirmations: Procedures and Requirements for the CPA Exam

Overview of External Confirmations in Auditing

External confirmations are a form of audit evidence obtained as a direct written response to the auditor from a third party. Under AU-C Section 505, external confirmations provide highly reliable evidence because they are obtained from sources independent of the entity. They are used to verify assertions about account balances, terms of agreements, and the existence of transactions. Confirmation procedures are one of the most tested topics on the CPA AUD exam.

The auditor maintains control over the confirmation process throughout. This means the auditor selects the items to be confirmed, designs the confirmation request, sends the request directly to the confirming party, and receives the response directly. Management should not have the opportunity to intercept or alter confirmation requests or responses, as doing so would undermine the reliability of the evidence.

Types of Confirmations

Positive Confirmations

A positive confirmation request asks the confirming party to respond in all cases, either by indicating agreement with the information provided or by furnishing the requested information. There are two forms of positive confirmations. A blank form confirmation asks the respondent to fill in the balance or other information without providing any amounts, requiring the respondent to check their own records. An information-included confirmation provides the balance or terms and asks the respondent to confirm whether the information is correct. Blank form confirmations are generally considered more reliable because the respondent must independently determine the correct amount.

Negative Confirmations

A negative confirmation request asks the respondent to reply only if they disagree with the information provided. Negative confirmations provide less persuasive evidence than positive confirmations because the lack of a response could mean the respondent agrees, did not receive the request, or simply did not bother to reply. Under AU-C Section 505, negative confirmations may be used as the sole substantive procedure only when all four of the following conditions are met: the assessed risk of material misstatement is low, the population consists of a large number of small homogeneous balances, a very low exception rate is expected, and the auditor has no reason to believe that recipients will disregard the requests.

Key Areas Where Confirmations Are Used

Accounts Receivable

Confirmation of accounts receivable is a generally accepted auditing procedure. There is a presumption that the auditor will confirm receivables unless the balance is immaterial, confirmations would be ineffective (such as when response rates are historically very low), or the assessed risk of material misstatement is low and other substantive procedures provide sufficient evidence. When the auditor departs from the presumption, the auditor must document the reasons.

Bank Confirmations

Bank confirmations verify cash balances, loan balances, and other banking arrangements. The AICPA Standard Form to Confirm Account Balance Information with Financial Institutions is widely used. Bank confirmations provide evidence about the existence and completeness of cash accounts, outstanding loans, contingent liabilities, and compensating balance arrangements.

Accounts Payable and Other Balances

Confirmations of accounts payable are less common because external documents such as vendor invoices and statements are readily available. When confirmations are used for payables, they typically employ blank form requests to verify completeness, asking vendors to provide the balance owed to them rather than confirming a stated amount.

Handling Nonresponses and Exceptions

When the auditor does not receive a response to a positive confirmation, the auditor must perform alternative procedures to obtain the necessary evidence. For accounts receivable, alternative procedures typically include examining subsequent cash receipts, examining shipping documents, and reviewing customer correspondence. If the auditor cannot obtain sufficient evidence through confirmation or alternative procedures, the auditor considers the implications for the audit opinion.

Exceptions are responses that indicate a difference between the amount confirmed and the amount recorded. The auditor must investigate all exceptions to determine whether they represent misstatements, timing differences, or other explainable items. Common causes of exceptions include payments in transit, goods in transit, and disputed amounts.

Electronic Confirmations

Confirmations may be sent and received electronically, but the auditor must consider the risks associated with electronic communications, including the risk that the response may not come from the intended party. The auditor should implement procedures to address these risks, such as verifying the sender's identity and using secure transmission methods.

CPA Exam Tips

• Know the four conditions required to use negative confirmations as the sole substantive procedure.
• Understand that the auditor must maintain control over the entire confirmation process.
• Blank form confirmations are more reliable than information-included confirmations but typically have lower response rates.
• When management refuses to allow the auditor to send confirmations, it is a scope limitation that may affect the audit opinion.
• Alternative procedures must be performed for nonresponses to positive confirmations but are not required for nonresponses to negative confirmations.