Audit confirmations are information requests, typically distributed by email or through secure portals, in which accountants ask third parties to confirm information provided by the company being audited.
Audit confirmations are a powerful tool for auditors that provide independent evidence to substantiate various financial statement assertions.
To be considered credible, the confirmation process should be performed between the auditor and the third party verifying the requested information. Confirmations received directly by the auditor from the confirming parties are more reliable than evidence generated internally by the audited entity.
For example, a company being audited providing bank statements is not considered credible evidence because the statements may have been created or edited by the company. Instead, the auditor interacting directly with the bank to verify balances mitigates the risk of a statement containing inaccurate or modified information. As such, auditors perform bank confirmations to validate the information on the bank statements received from the company.
Audit confirmations can be categorized by their format:
- Positive Confirmations – Recipients are asked to respond directly to the auditor, confirming whether they agree or disagree with the provided information. This format is considered more reliable as it requires explicit acknowledgment from the respondent.
- Negative Confirmations – Recipients only need to respond if they disagree with the information presented. This format is less reliable because a non-response is assumed as agreement.
- Blank Confirmations – These do not specify amounts or details. Instead, recipients are asked to provide the requested information directly to the auditor.
What Types of Information Are Included in Audit Confirmations?
While specific inquiries can vary according to the company, industry, or specific risk factors, common confirmation requests center around:
- Accounts payable
- Accounts receivable
- Cash and cash equivalents
- Debt
- Inventory
- Pending legal action
- Sales terms and agreements
- Stock issuances
The Updated Confirmations Standard
In late 2023, the SEC and the PCAOB approved AS 2301, The Auditor’s Use of Confirmation, to replace guidance for audits of public companies. The new standard, which emphasizes auditors’ responsibility to use confirmations to obtain reliable audit evidence, makes a number of changes that include:
- Adding a requirement to confirm cash (and equivalents) held by third parties, or accessing information maintained by an external source (such as an online account balance).
- The elimination of negative confirmations for audits of public companies subject to PCAOB standards. Emphasizing the auditor’s responsibility to control the confirmation process, including selecting information to be confirmed and receiving confirmation responses directly.
While these changes do not impact private company audits, it is important to consider these changes when evaluating the sufficiency of confirmations for an audit.
Alternate Confirmation Methods
If a third party does not provide the requested confirmation or does not agree with the information presented for confirmation, auditors can use alternative methods to verify information. These may include:
- Inspecting documents. These may include invoices, shipping records, contracts, cash receipts, or other information.
- Reviewing subsequent cash receipts for accounts receivable, such as inspecting documentation for product delivery or services performed, or voucher payments subsequent to year-end bank statements, to provide evidence for values being asserted.
- Performing analytical procedures. These may include analyzing financial data to identify trends.
- Conducting physical observation, such as inventory counts or watching processes.
- Interviewing management and employees about transactions or account balances.
- Expanding sample sizes for testing or performing additional testing procedures.
Common Confirmation Challenges
Several potential obstacles can hinder the effective use of confirmation requests in the audit process. For instance, many large enterprises, as a matter of policy, will not respond to requests related to their suppliers or other business partners.
In other instances, a company may have outdated contact information for the third party, so a confirmation request is never received. Another common challenge is a data entry error, such as transposing two digits, that causes a mismatch between specified amounts in two locations. In these situations, auditors will turn to the alternative methods described earlier.
If you have questions about the use of confirmations during the audit process, contact us.