External Confirmations — Evaluate Confirmation Responses - CPA Aud

SECTION 1

Historical Context & Motivation

The practice of seeking independent verification from outside parties has been central to auditing since the profession began formalizing its standards in the early twentieth century. Before external confirmations became a codified procedure, auditors relied almost exclusively on internal documentation provided by management—a source inherently susceptible to manipulation. High-profile fraud cases exposed the limitations of this approach and drove standard-setters to require auditors to obtain evidence directly from third parties, particularly for material account balances such as accounts receivable, bank balances, and accounts payable. The evaluation of those confirmation responses—determining their reliability, resolving exceptions, and assessing whether non-responses require alternative procedures—has become one of the most nuanced judgment areas in modern audit practice.

1938 • McKesson & Robbins Scandal

A massive inventory and receivables fraud at McKesson & Robbins revealed that auditors had not confirmed balances with outside parties, prompting the AICPA to recommend external confirmations as a standard audit procedure.

1991 • SAS No. 67 Issued

The AICPA issued Statement on Auditing Standards No. 67, 'The Confirmation Process,' establishing detailed guidance on designing, sending, and evaluating confirmation requests.

2001–2002 • Enron & WorldCom Collapses

Corporate fraud scandals intensified regulatory scrutiny of audit evidence quality, reinforcing the need for rigorous evaluation of third-party responses and greater professional skepticism.

2010 • AU-C Section 505 (Clarified)

The ASB issued the clarified standard AU-C 505, External Confirmations, aligning U.S. GAAS more closely with ISA 505 and emphasizing the auditor's responsibility to evaluate the reliability of confirmation responses.

2020s • Electronic Confirmations & Automation

Third-party confirmation platforms such as Confirmation.com introduced encrypted electronic confirmations, raising new evaluation questions about digital response authenticity and the reliability of intermediaries.

The central question this lesson addresses is deceptively straightforward: once the auditor receives (or fails to receive) a response to an external confirmation request, how should that response be evaluated to determine whether it constitutes sufficient appropriate audit evidence? The answer requires understanding the nature of the response, the risks of interception or manipulation, the treatment of exceptions and discrepancies, and the alternative procedures available when confirmations are not returned.

SECTION 2

Core Principles & Definitions

Evaluating confirmation responses requires the auditor to apply a structured set of principles grounded in AU-C Section 505 and the broader framework of audit evidence quality established in AU-C 500. The auditor must consider the relevance and reliability of each response, the nature of any discrepancies between the confirmed amount and the client's records, and the implications of non-responses on the overall sufficiency of evidence. These principles collectively ensure that confirmation evidence meets the assertions being tested—most commonly existence, rights and obligations, completeness, and valuation.

Reliability of the Source

A confirmation response is more reliable when it comes directly from a knowledgeable, independent third party. The auditor must assess whether the respondent is in a position to provide accurate information and whether the response was transmitted through a secure channel free from management interception.

Positive vs. Negative Confirmations

Positive confirmations ask the respondent to reply whether they agree or disagree. Negative confirmations request a reply only if the respondent disagrees. Non-responses to negative confirmations provide less persuasive evidence because the auditor cannot distinguish between agreement and simple neglect.

Exceptions & Discrepancies

An exception arises when the confirmed amount differs from the client's recorded amount. The auditor must investigate each exception to determine whether it results from a timing difference, a misstatement, or a misunderstanding by the respondent.

Non-Responses & Alternative Procedures

When a positive confirmation is not returned, the auditor must perform alternative procedures—such as examining subsequent cash receipts or shipping documents—to obtain evidence about the assertion. The nature and extent of alternative procedures depend on the assessed risk of material misstatement.

Management Requests to Not Confirm

When management requests the auditor not to confirm certain balances, the auditor must evaluate the reasonableness of the request and, if deemed unreasonable, consider the implications for the overall audit strategy and the assessment of fraud risk.

✦

KEY TAKEAWAY

Think of an external confirmation like a credit reference check on a loan application. The bank does not simply trust the borrower's self-reported income; it contacts employers, reviews tax returns from the IRS, and verifies account balances with other institutions. Similarly, the auditor seeks independent corroboration of management's financial statement assertions. But just as a forged employer letter would undermine the credit check, a confirmation response that has been intercepted or manipulated by management provides no real assurance. The auditor's job is to evaluate each response with professional skepticism, not merely tally replies received.

SECTION 3

Visual Explanation — The Confirmation Evaluation Flowchart

This flowchart traces the auditor's decision process from the moment a confirmation is sent through receipt (or non-receipt) of a response. The left branch handles non-responses requiring follow-up and alternative procedures, while the right branch evaluates received responses for exceptions versus confirming replies. Exceptions are further classified as timing differences or potential misstatements.

The diagram above illustrates the two primary paths an auditor faces after dispatching a confirmation request. When a response is received, the auditor does not simply file it away as supporting evidence; instead, the response must be scrutinized for signs that it may have been intercepted by management, sent from an invalid address, or completed by someone without actual knowledge of the balance. When the response contains an exception—a discrepancy between the confirmed amount and the recorded amount—the auditor must investigate whether the difference is attributable to a benign timing issue (such as goods in transit or payments crossing in the mail) or whether it indicates a genuine misstatement that must be accumulated under AU-C 450. The non-response path is equally significant: when a second request also goes unanswered, the auditor must design and execute alternative procedures sufficient to provide the evidence the confirmation was intended to supply.

SECTION 4

How It Works — Evaluating Response Reliability & Sufficiency

Step 1: Verify the Authenticity of the Response

The auditor's first task upon receiving a confirmation response is to assess its authenticity. AU-C 505 recognizes that fraud risk increases when management has the opportunity to intercept and alter confirmations before they reach the auditor. The auditor should consider whether the response was returned directly to the auditor (not routed through the client), whether the letterhead and contact details correspond to a legitimate business, and whether electronic responses originate from verified email domains or secure confirmation platforms. If the auditor has any doubt about authenticity, additional procedures—such as calling the confirming party directly—are necessary.

Step 2: Classify the Response

Responses fall into three broad categories. A confirming response agrees with the recorded balance and, assuming the auditor is satisfied with its reliability, constitutes strong corroborating evidence for the existence and accuracy assertions. An exception response reports a different amount or identifies terms that conflict with the client's records. A non-response occurs when the confirming party fails to reply altogether, and—critically—it provides zero audit evidence for positive confirmations. Each category triggers a different set of follow-up actions.

Step 3: Investigate Exceptions

Exceptions require the auditor to reconcile the discrepancy. Common benign explanations include timing differences—payments in transit, goods shipped but not yet received by the customer, or credit memos not yet recorded. However, the auditor must also consider whether the exception reveals a misstatement arising from errors or fraud. The investigation typically involves examining supporting documents such as remittance advices, shipping logs, purchase orders, and subsequent payment records. If the exception cannot be satisfactorily explained, the auditor records it as a misstatement and evaluates its effect on the financial statements, including potential projection to the population.

Step 4: Perform Alternative Procedures for Non-Responses

When a positive confirmation request goes unanswered despite follow-up attempts, the auditor cannot simply disregard the item. Alternative procedures must be designed to test the same assertion that the confirmation was intended to address. For accounts receivable, these commonly include examining subsequent cash receipts traceable to the specific invoice, inspecting shipping documents or delivery receipts, and reviewing the sales contract or purchase order. The evidence obtained through alternative procedures may be less persuasive than a direct confirmation, and the auditor must exercise judgment in assessing whether the combined evidence is sufficient.

Step 5: Evaluate Aggregate Results

After processing all responses, exceptions, and alternative procedures, the auditor aggregates the results to assess whether the confirmation process—as a whole—has provided sufficient appropriate evidence. Key considerations include the response rate, the dollar value of confirmed versus unconfirmed items, the nature and frequency of exceptions, and whether misstatements identified suggest a pattern that could indicate systemic error or fraud. A low response rate combined with significant unresolved exceptions may compel the auditor to expand testing, revise the risk assessment, or consider the implications for the audit report.

SECTION 5

Detailed Breakdown — Types of Confirmation Responses

The three primary response categories are shown with their corresponding evidence quality levels and required auditor actions. The reliability spectrum at the bottom illustrates how the channel of communication affects the persuasiveness of the evidence obtained.

Response Type	Characteristics	Auditor Action Required	Evidence Strength
Confirming (Positive)	Third party agrees with the recorded balance in full	Verify authenticity; file as evidence; no further procedures for this item	Strong
Exception	Third party reports a different amount or disagrees with terms	Investigate cause; determine if timing difference or misstatement; accumulate if misstatement	Variable — depends on resolution
Non-Response (Positive Conf.)	No reply received despite follow-up attempts	Perform alternative procedures (e.g., subsequent cash receipts, shipping documents)	None until alt. procedures completed
Non-Response (Negative Conf.)	No reply; inherent design means no response implies agreement	May accept as evidence only if risk is low; no way to confirm the respondent actually received the request	Low — cannot distinguish agreement from neglect

Comparison of confirmation response types by characteristics, required actions, and evidence strength

SECTION 6

Worked Example — Evaluating Accounts Receivable Confirmations

Consider an audit engagement for Apex Manufacturing Co., a mid-sized company with a December 31 fiscal year-end. The auditor selected 50 accounts receivable balances totaling $4,200,000 for positive confirmation. The total accounts receivable balance on the trial balance is $8,500,000. The results are as follows: 35 confirmations returned agreeing with the balance, 8 confirmations returned with exceptions, and 7 confirmations received no response despite a second mailing.

Evaluating Apex Manufacturing's Confirmation Results

1
Step 1 — Assess the Response Rate

Out of 50 positive confirmations sent, 43 responses were received (35 confirming + 8 exceptions), yielding a response rate of 43 ÷ 50 = 86%. This is a reasonably strong response rate. The 7 non-responses (14%) will require alternative procedures. The auditor documents the response rate and notes that it falls within an acceptable range for the assessed level of risk.

Response Rate: 86% (43 of 50)
2
Step 2 — Evaluate Confirming Responses

For the 35 agreeing responses, the auditor verifies that each was received directly (not routed through the client), that the respondent's details match the auditor's records, and that no signs of alteration or forgery are present. The auditor confirms that these 35 responses, totaling $2,850,000, provide strong evidence that those receivable balances exist and are accurately stated.

35 confirming responses = $2,850,000 corroborated
3
Step 3 — Investigate the 8 Exceptions

Exception 1: Customer Alpha reports owing $95,000 versus Apex's recorded $102,000. Investigation reveals a $7,000 payment mailed by Alpha on December 29 that was received and deposited by Apex on January 3. This is a timing difference—the payment was in transit at year-end. No misstatement. Exceptions 2–6: Similar timing differences totaling $22,000, all traced to payments or shipments crossing at year-end. All resolved as timing differences. Exception 7: Customer Beta confirms $0 balance; Apex records $48,000. Investigation reveals that Beta returned the goods on December 15 but Apex had not recorded the credit memo. This is a misstatement of $48,000. Exception 8: Customer Gamma reports owing $60,000 versus Apex's $60,000 but notes the goods were received damaged and a dispute is pending. The auditor considers the collectibility of this receivable and the need for an allowance.

6 timing differences resolved; 1 misstatement of $48,000 identified; 1 valuation concern flagged
4
Step 4 — Perform Alternative Procedures for 7 Non-Responses

For the 7 non-responses totaling $490,000, the auditor examines subsequent cash receipts. For 5 of the 7 items ($420,000), the auditor traces payments received in January to the specific invoices outstanding at December 31, providing evidence that the balances existed. For 1 item ($45,000), the auditor examines the shipping documents and signed delivery receipt confirming goods were delivered in December. For the remaining 1 item ($25,000), neither subsequent receipts nor shipping documents are available; the auditor examines the sales contract, customer purchase order, and the original invoice. After evaluating all available evidence, the auditor determines this last item requires further scrutiny and contacts the customer directly by phone.

6 of 7 non-responses satisfactorily resolved via alternative procedures; 1 item ($25,000) requires additional follow-up
5
Step 5 — Aggregate Results and Conclude

The auditor aggregates all findings: $2,850,000 confirmed directly, $860,000 confirmed through exception resolution and alternative procedures, and a $48,000 identified misstatement. The auditor also considers whether the $48,000 misstatement (an unrecorded credit memo) might be indicative of a systematic problem and evaluates whether the error should be projected to the untested portion of accounts receivable. The $25,000 item still under investigation is tracked, and the disputed $60,000 Gamma balance is discussed with management regarding the need for an allowance for doubtful accounts. The auditor concludes that, subject to the resolution of the remaining open items, sufficient appropriate evidence has been obtained for the accounts receivable balance.

Identified misstatement: $48,000 (project to population if systematic); Overall: sufficient evidence obtained, pending resolution of 2 open items

SECTION 7

Strengths & Limitations of External Confirmations

Strengths	Limitations
Evidence obtained directly from independent third parties is among the most reliable forms of audit evidence under AU-C 500	Confirmations address existence and rights/obligations more effectively than completeness; unrecorded liabilities may not be detected
Difficult for management to manipulate when the auditor maintains control over the confirmation process from dispatch to receipt	Response rates can be low, particularly for smaller customers or international counterparties, reducing the persuasiveness of the overall procedure
Electronic confirmation platforms increase speed and reduce the risk of interception by management	Respondents may not fully understand the amounts being confirmed or may provide inaccurate information through carelessness
Provides direct evidence for highly significant assertions (e.g., cash balances with banks, loan terms with lenders)	Negative confirmations provide only limited assurance because the auditor cannot confirm the respondent received and reviewed the request
Results can be quantified and projected to the untested population, supporting statistical conclusions	Alternative procedures for non-responses may be less persuasive and more time-consuming, potentially delaying audit completion

Strengths and limitations of external confirmations as an audit procedure

✦

KEY TAKEAWAY

External confirmations are often described as the 'gold standard' of audit evidence for existence-related assertions, but they are not a panacea. Think of confirmations as a diagnostic test in medicine: a positive test result (confirming response) is highly informative, but a failure to get a result (non-response) is not the same as a clean bill of health. The auditor must understand both the power and the limitations of confirmations within the broader evidence-gathering strategy to form an appropriate audit opinion.

SECTION 8

Connection to Advanced Audit Theory & PCAOB Considerations

While AU-C 505 governs external confirmations for non-issuers under AICPA standards, auditors of public companies must also consider PCAOB AS 2310 (The Confirmation Process), which imposes substantially similar requirements but with heightened expectations regarding professional skepticism and the documentation of the auditor's evaluation of response reliability. The PCAOB's inspection findings have repeatedly identified deficiencies where auditors failed to adequately investigate exceptions, accepted oral confirmations without corroborating written evidence, or neglected to perform sufficient alternative procedures for non-responses. Understanding the distinction between these standard-setting frameworks is essential for CPA candidates, as the AUD exam may present scenarios under either regime.

Feature	AU-C 505 (Non-Issuers / AICPA)	AS 2310 (Issuers / PCAOB)
Presumption to Confirm AR	No explicit presumption; the auditor considers whether confirmations are appropriate based on circumstances	Presumption that the auditor will confirm accounts receivable unless specific conditions are met (e.g., AR is immaterial, confirmations would be ineffective)
Management Refusal to Allow	Auditor evaluates reasonableness; if unreasonable, treat as a scope limitation and consider the impact on the opinion	Similar treatment; however, PCAOB inspectors have emphasized that auditors must thoroughly document the rationale if management's refusal is accepted
Electronic Confirmations	Acceptable if the auditor assesses that the process provides sufficient security and authenticity	Acceptable; PCAOB Staff Audit Practice Alert No. 8 provides additional guidance on evaluating electronic confirmation intermediaries
Negative Confirmations	Permitted only when the risk of material misstatement is low, the population consists of small homogeneous items, and the auditor expects a low exception rate	Substantially the same conditions; PCAOB emphasizes that negative confirmations alone generally do not provide sufficient evidence

Comparison of confirmation evaluation requirements under AICPA (AU-C 505) and PCAOB (AS 2310) frameworks

Looking forward, the profession is moving toward increasingly automated and technology-driven confirmation processes. Blockchain-based ledger verification, continuous auditing platforms, and artificial intelligence tools that can cross-reference confirmation data with public records all promise to enhance the reliability and efficiency of the confirmation process. However, these advances do not eliminate the need for auditor judgment in evaluating responses—they simply provide new channels through which evidence is obtained, each with its own reliability considerations that the auditor must assess.

SECTION 9

Practice Problems

Question 1: CONCEPTUAL

When evaluating the results of external confirmation procedures, which of the following best describes an "exception" on a confirmation response?

A. A confirmation that is returned by the postal service as undeliverable.
B. A response that indicates a difference between the information on the confirmation request and the information provided by the confirming party.
C. A confirmation request for which no response is received from the third party.
D. A response that agrees with all amounts on the confirmation request but is received after the auditor's report date.

Show answer

The correct answer is B. An exception on a confirmation response exists when there is a difference between the information requested and the information provided by the confirming party. This difference may or may not indicate a misstatement and requires the auditor to investigate further. Choice A is incorrect because an undeliverable confirmation is a nonresponse issue, not an exception. Choice C is incorrect because a nonresponse (no reply received) is classified as a nonresponse rather than an exception — the auditor must perform alternative procedures for nonresponses. Choice D is incorrect because a confirmation that agrees with all amounts is a confirming response regardless of when it is received, though its timeliness may affect its usefulness.

Question 2: BASIC CALCULATION

An auditor sent 80 accounts receivable confirmation requests. Fifty-five were returned agreeing with the recorded balances, 10 were returned with exceptions, and 15 were not returned. For the 15 nonresponses, the auditor performed alternative procedures and was able to obtain sufficient appropriate evidence for 12 of them. What is the total number of confirmation items for which the auditor still needs to evaluate the implications on the audit?

A. 3
B. 10
C. 13
D. 25

Show answer

The correct answer is C. The auditor must further evaluate 10 items returned with exceptions (to determine whether they indicate misstatements) plus the 3 nonresponses for which alternative procedures did not provide sufficient appropriate evidence, totaling 13 items. Choice A is incorrect because it only considers the 3 unsatisfied nonresponses and ignores the 10 exceptions, which also require investigation. Choice B is incorrect because it only considers the 10 exceptions and ignores the 3 nonresponses that remain unresolved. Choice D is incorrect because it adds all 15 nonresponses to the 10 exceptions (25), failing to recognize that alternative procedures successfully resolved 12 of the 15 nonresponses.

Question 3: INTERMEDIATE

An auditor receives a confirmation response from a customer of the audit client that reports a balance significantly lower than the amount recorded in the client's accounts receivable subsidiary ledger. Upon investigation, the auditor determines that the client recorded a large sale on the last day of the fiscal year, but the customer did not record the purchase until two days after year-end. Which of the following is the most appropriate conclusion?

A. The exception represents a misstatement that should be included in the summary of audit differences.
B. The exception is likely due to a timing difference and does not necessarily indicate a misstatement in the client's records.
C. The auditor should request the client to adjust the accounts receivable balance to agree with the customer's records.
D. The confirmation response is unreliable and should be disregarded entirely.

Show answer

The correct answer is B. Many confirmation exceptions result from timing differences — such as goods in transit or payments in transit — rather than actual misstatements. In this case, the client properly recorded the sale before year-end, but the customer had not yet recorded the purchase, which explains the discrepancy. The auditor should verify that the sale was valid and the goods were shipped before year-end. Choice A is incorrect because a timing difference does not constitute a misstatement if the client's cutoff is proper. Choice C is incorrect because the client's records may be correct; the customer's records simply reflect a different cutoff. Choice D is incorrect because the confirmation response is not unreliable — it accurately reflects the customer's records at a different point in time, and the auditor was able to investigate and explain the difference.

Question 4: APPLIED

During the confirmation process for accounts receivable, an auditor notices that several confirmation responses were returned via fax directly from the client's office rather than being mailed directly to the auditor. What should the auditor do in response to this situation?

A. Accept the faxed confirmations as sufficient audit evidence since they contain the confirming party's signature.
B. Contact the confirming parties directly to validate the information on the faxed responses and consider whether the responses are reliable.
C. Discard all faxed confirmations and send new confirmation requests to those parties by mail.
D. Include the faxed responses in the working papers without additional procedures since fax is a commonly accepted medium.

Show answer

The correct answer is B. When confirmation responses are received through the client rather than directly from the confirming party, the auditor has reason to question the reliability and authenticity of the responses because the client may have altered or fabricated them. The auditor should contact the purported confirming parties directly to verify the accuracy and authenticity of the responses. Choice A is incorrect because a signature on a faxed response routed through the client does not provide assurance that the response is genuine, as the client could have forged or manipulated the document. Choice C is incorrect because while resending confirmations may be appropriate in some cases, the auditor's first step should be to verify the responses already received; simply discarding them and resending is not the most efficient or most appropriate immediate action. Choice D is incorrect because the concern is not the medium (fax) but rather the route — responses that pass through the client's hands lack the reliability of responses sent directly to the auditor.

Question 5: CRITICAL THINKING

An auditor sent positive confirmation requests for a sample of 50 accounts receivable balances. Of the 50 requests, 30 were returned with no exceptions, 8 were returned with exceptions that upon investigation were determined to be timing differences, 5 were returned with exceptions indicating potential misstatements, and 7 were nonresponses for which alternative procedures were inconclusive. The auditor also notes that the nonresponding accounts include two of the five largest receivable balances. Which of the following best describes the appropriate auditor response?

A. Conclude that the confirmation results are satisfactory since 38 of the 50 confirmations were resolved without issues.
B. Expand the sample and perform additional substantive procedures, assess the effect of the unresolved items on the assessed risk of material misstatement, and consider the implications for the audit opinion.
C. Project the 5 confirmed misstatements to the population and issue a qualified opinion if the projected misstatement exceeds materiality.
D. Request management to provide written representations that the 7 nonresponding accounts and 5 exception accounts are properly stated, which would be sufficient to resolve the matter.

Show answer

The correct answer is B. When confirmation results include unresolved exceptions indicating potential misstatements and significant nonresponses (especially involving large balances for which alternative procedures were inconclusive), the auditor must reassess the risk of material misstatement and determine whether additional audit evidence is needed. The combination of 5 potential misstatements and 7 inconclusive nonresponses — including two of the five largest balances — represents a significant portion of unresolved items that could materially affect the financial statements. Choice A is incorrect because 12 of the 50 items (24%) remain unresolved, including large-dollar items, which is not a satisfactory result and cannot simply be dismissed. Choice C is incorrect because the auditor should not jump to projecting misstatements and modifying the opinion without first performing additional procedures to gather more evidence; also, the 5 items have only been identified as potential misstatements that require further investigation. Choice D is incorrect because management representations alone are not sufficient appropriate audit evidence to resolve confirmation exceptions and nonresponses, particularly for material accounts — they supplement but do not replace substantive audit procedures.

SUMMARY

Summary — Evaluating Confirmation Responses

Summary

Evaluating confirmation responses is a critical audit judgment that requires far more than tallying the number of replies received. Under AU-C 505 and PCAOB AS 2310, the auditor must assess the authenticity and reliability of each response, classify it as a confirming response, an exception, or a non-response, and then take the appropriate follow-up action. Exceptions must be investigated to determine whether they result from timing differences or misstatements, and non-responses to positive confirmations require alternative procedures such as examining subsequent cash receipts and shipping documents.

The auditor must aggregate all results—confirmed amounts, resolved exceptions, misstatements, and evidence from alternative procedures—to form an overall conclusion about whether sufficient appropriate audit evidence has been obtained for the relevant assertions. Key factors include the response rate, the dollar concentration of non-responses, the nature and pattern of exceptions, and whether management requests to restrict confirmations raise fraud risk concerns. Throughout this process, professional skepticism is the auditor's most important tool.