Historical Context & Motivation
The practice of seeking independent verification from outside parties has been central to auditing since the profession began formalizing its standards in the early twentieth century. Before external confirmations became a codified procedure, auditors relied almost exclusively on internal documentation provided by management—a source inherently susceptible to manipulation. High-profile fraud cases exposed the limitations of this approach and drove standard-setters to require auditors to obtain evidence directly from third parties, particularly for material account balances such as accounts receivable, bank balances, and accounts payable. The evaluation of those confirmation responses—determining their reliability, resolving exceptions, and assessing whether non-responses require alternative procedures—has become one of the most nuanced judgment areas in modern audit practice.
The central question this lesson addresses is deceptively straightforward: once the auditor receives (or fails to receive) a response to an external confirmation request, how should that response be evaluated to determine whether it constitutes sufficient appropriate audit evidence? The answer requires understanding the nature of the response, the risks of interception or manipulation, the treatment of exceptions and discrepancies, and the alternative procedures available when confirmations are not returned.
Core Principles & Definitions
Evaluating confirmation responses requires the auditor to apply a structured set of principles grounded in AU-C Section 505 and the broader framework of audit evidence quality established in AU-C 500. The auditor must consider the relevance and reliability of each response, the nature of any discrepancies between the confirmed amount and the client's records, and the implications of non-responses on the overall sufficiency of evidence. These principles collectively ensure that confirmation evidence meets the assertions being tested—most commonly existence, rights and obligations, completeness, and valuation.
Reliability of the Source
Positive vs. Negative Confirmations
Exceptions & Discrepancies
Non-Responses & Alternative Procedures
Management Requests to Not Confirm
Visual Explanation — The Confirmation Evaluation Flowchart
The diagram above illustrates the two primary paths an auditor faces after dispatching a confirmation request. When a response is received, the auditor does not simply file it away as supporting evidence; instead, the response must be scrutinized for signs that it may have been intercepted by management, sent from an invalid address, or completed by someone without actual knowledge of the balance. When the response contains an exception—a discrepancy between the confirmed amount and the recorded amount—the auditor must investigate whether the difference is attributable to a benign timing issue (such as goods in transit or payments crossing in the mail) or whether it indicates a genuine misstatement that must be accumulated under AU-C 450. The non-response path is equally significant: when a second request also goes unanswered, the auditor must design and execute alternative procedures sufficient to provide the evidence the confirmation was intended to supply.
How It Works — Evaluating Response Reliability & Sufficiency
Step 1: Verify the Authenticity of the Response
The auditor's first task upon receiving a confirmation response is to assess its authenticity. AU-C 505 recognizes that fraud risk increases when management has the opportunity to intercept and alter confirmations before they reach the auditor. The auditor should consider whether the response was returned directly to the auditor (not routed through the client), whether the letterhead and contact details correspond to a legitimate business, and whether electronic responses originate from verified email domains or secure confirmation platforms. If the auditor has any doubt about authenticity, additional procedures—such as calling the confirming party directly—are necessary.
Step 2: Classify the Response
Responses fall into three broad categories. A confirming response agrees with the recorded balance and, assuming the auditor is satisfied with its reliability, constitutes strong corroborating evidence for the existence and accuracy assertions. An exception response reports a different amount or identifies terms that conflict with the client's records. A non-response occurs when the confirming party fails to reply altogether, and—critically—it provides zero audit evidence for positive confirmations. Each category triggers a different set of follow-up actions.
Step 3: Investigate Exceptions
Exceptions require the auditor to reconcile the discrepancy. Common benign explanations include timing differences—payments in transit, goods shipped but not yet received by the customer, or credit memos not yet recorded. However, the auditor must also consider whether the exception reveals a misstatement arising from errors or fraud. The investigation typically involves examining supporting documents such as remittance advices, shipping logs, purchase orders, and subsequent payment records. If the exception cannot be satisfactorily explained, the auditor records it as a misstatement and evaluates its effect on the financial statements, including potential projection to the population.
Step 4: Perform Alternative Procedures for Non-Responses
When a positive confirmation request goes unanswered despite follow-up attempts, the auditor cannot simply disregard the item. Alternative procedures must be designed to test the same assertion that the confirmation was intended to address. For accounts receivable, these commonly include examining subsequent cash receipts traceable to the specific invoice, inspecting shipping documents or delivery receipts, and reviewing the sales contract or purchase order. The evidence obtained through alternative procedures may be less persuasive than a direct confirmation, and the auditor must exercise judgment in assessing whether the combined evidence is sufficient.
Step 5: Evaluate Aggregate Results
After processing all responses, exceptions, and alternative procedures, the auditor aggregates the results to assess whether the confirmation process—as a whole—has provided sufficient appropriate evidence. Key considerations include the response rate, the dollar value of confirmed versus unconfirmed items, the nature and frequency of exceptions, and whether misstatements identified suggest a pattern that could indicate systemic error or fraud. A low response rate combined with significant unresolved exceptions may compel the auditor to expand testing, revise the risk assessment, or consider the implications for the audit report.
Detailed Breakdown — Types of Confirmation Responses
| Response Type | Characteristics | Auditor Action Required | Evidence Strength |
|---|---|---|---|
| Confirming (Positive) | Third party agrees with the recorded balance in full | Verify authenticity; file as evidence; no further procedures for this item | Strong |
| Exception | Third party reports a different amount or disagrees with terms | Investigate cause; determine if timing difference or misstatement; accumulate if misstatement | Variable — depends on resolution |
| Non-Response (Positive Conf.) | No reply received despite follow-up attempts | Perform alternative procedures (e.g., subsequent cash receipts, shipping documents) | None until alt. procedures completed |
| Non-Response (Negative Conf.) | No reply; inherent design means no response implies agreement | May accept as evidence only if risk is low; no way to confirm the respondent actually received the request | Low — cannot distinguish agreement from neglect |
Worked Example — Evaluating Accounts Receivable Confirmations
Consider an audit engagement for Apex Manufacturing Co., a mid-sized company with a December 31 fiscal year-end. The auditor selected 50 accounts receivable balances totaling $4,200,000 for positive confirmation. The total accounts receivable balance on the trial balance is $8,500,000. The results are as follows: 35 confirmations returned agreeing with the balance, 8 confirmations returned with exceptions, and 7 confirmations received no response despite a second mailing.
Strengths & Limitations of External Confirmations
| Strengths | Limitations |
|---|---|
| Evidence obtained directly from independent third parties is among the most reliable forms of audit evidence under AU-C 500 | Confirmations address existence and rights/obligations more effectively than completeness; unrecorded liabilities may not be detected |
| Difficult for management to manipulate when the auditor maintains control over the confirmation process from dispatch to receipt | Response rates can be low, particularly for smaller customers or international counterparties, reducing the persuasiveness of the overall procedure |
| Electronic confirmation platforms increase speed and reduce the risk of interception by management | Respondents may not fully understand the amounts being confirmed or may provide inaccurate information through carelessness |
| Provides direct evidence for highly significant assertions (e.g., cash balances with banks, loan terms with lenders) | Negative confirmations provide only limited assurance because the auditor cannot confirm the respondent received and reviewed the request |
| Results can be quantified and projected to the untested population, supporting statistical conclusions | Alternative procedures for non-responses may be less persuasive and more time-consuming, potentially delaying audit completion |
Connection to Advanced Audit Theory & PCAOB Considerations
While AU-C 505 governs external confirmations for non-issuers under AICPA standards, auditors of public companies must also consider PCAOB AS 2310 (The Confirmation Process), which imposes substantially similar requirements but with heightened expectations regarding professional skepticism and the documentation of the auditor's evaluation of response reliability. The PCAOB's inspection findings have repeatedly identified deficiencies where auditors failed to adequately investigate exceptions, accepted oral confirmations without corroborating written evidence, or neglected to perform sufficient alternative procedures for non-responses. Understanding the distinction between these standard-setting frameworks is essential for CPA candidates, as the AUD exam may present scenarios under either regime.
| Feature | AU-C 505 (Non-Issuers / AICPA) | AS 2310 (Issuers / PCAOB) |
|---|---|---|
| Presumption to Confirm AR | No explicit presumption; the auditor considers whether confirmations are appropriate based on circumstances | Presumption that the auditor will confirm accounts receivable unless specific conditions are met (e.g., AR is immaterial, confirmations would be ineffective) |
| Management Refusal to Allow | Auditor evaluates reasonableness; if unreasonable, treat as a scope limitation and consider the impact on the opinion | Similar treatment; however, PCAOB inspectors have emphasized that auditors must thoroughly document the rationale if management's refusal is accepted |
| Electronic Confirmations | Acceptable if the auditor assesses that the process provides sufficient security and authenticity | Acceptable; PCAOB Staff Audit Practice Alert No. 8 provides additional guidance on evaluating electronic confirmation intermediaries |
| Negative Confirmations | Permitted only when the risk of material misstatement is low, the population consists of small homogeneous items, and the auditor expects a low exception rate | Substantially the same conditions; PCAOB emphasizes that negative confirmations alone generally do not provide sufficient evidence |
Looking forward, the profession is moving toward increasingly automated and technology-driven confirmation processes. Blockchain-based ledger verification, continuous auditing platforms, and artificial intelligence tools that can cross-reference confirmation data with public records all promise to enhance the reliability and efficiency of the confirmation process. However, these advances do not eliminate the need for auditor judgment in evaluating responses—they simply provide new channels through which evidence is obtained, each with its own reliability considerations that the auditor must assess.
Practice Problems
Summary — Evaluating Confirmation Responses
Evaluating confirmation responses is a critical audit judgment that requires far more than tallying the number of replies received. Under AU-C 505 and PCAOB AS 2310, the auditor must assess the authenticity and reliability of each response, classify it as a confirming response, an exception, or a non-response, and then take the appropriate follow-up action. Exceptions must be investigated to determine whether they result from timing differences or misstatements, and non-responses to positive confirmations require alternative procedures such as examining subsequent cash receipts and shipping documents.
The auditor must aggregate all results—confirmed amounts, resolved exceptions, misstatements, and evidence from alternative procedures—to form an overall conclusion about whether sufficient appropriate audit evidence has been obtained for the relevant assertions. Key factors include the response rate, the dollar concentration of non-responses, the nature and pattern of exceptions, and whether management requests to restrict confirmations raise fraud risk concerns. Throughout this process, professional skepticism is the auditor's most important tool.