External Confirmations

Introduction
ISA 500: Audit Evidence identifies seven audit procedures amongst which is External
Confirmation. This article looks at the specific procedure of external confirmations,
identifies the steps that should be followed in the audit confirmation process, the design
of the confirmation request, confirmations for specific accounts (trade receivables, bank,
trade payables, contingent liabilities and other accounts) and lastly gives a brief
overview of instances of audit failure involving confirmation evidence.

ISA 505: defines external confirmation as “audit evidence obtained as a direct written
response to the auditor from a third party (the confirming party), in paper form, or by
electronic or other other medium.” (para 6). For example,an auditor would in the normal
course of the audit seek direct confirmation of trade receivables by writing to customers
asking them to confirm amounts due by them to the client. As confirmations come from
sources independent of the client, they are highly persuasive and therefore a much used
type of evidence. However, they are also expensive and time-consuming and an
inconvenience to those asked to supply them. ISA 505 (para A5) requires that auditors
should determine “whether external confirmation procedures are an appropriate
response to an assessed risk of misstatement” but does not mandate their use in any
particular circumstances. In general auditors determine whether or not to use
confirmations depending on the reliability needs of the situation as well as the alternative
evidence available.



Design of the confirmation request
ISA 505 (para A8) states “The design of a confirmation request may directly affect the
confirmation response rate, and the reliability and the nature of audit evidence obtained
from responses”.
ISA 505 (para A9) goes on to outline a number of factors to consider when designing
confirmation requests including:
– The assertions being addressed
– Specific identified risks of misstatement, including fraud risks
– The layout and presentation of the confirmation request
– Prior experience on the audit or similar engagements
– The method of communication (paper, electronic, other)
– Management’s authorisation to the confirming parties to respond to the auditor
– The ability of the intended confirming party to confirm or provide the requested information

The confirming party must have the permission of the client to release the information.
To obain this permission the auditor asks the client to sign an authority letter to the
confirming parties authorising them to release any information the auditors may require
directly to them. It would be extremely serious if the client refused to sign the authority
letter. In this instance the auditor should explain that the confirmation request comprised
routine enquiries with regard to the affairs of the client and ensure that client is made
fully aware of its contents. If the auditor is not satisfied with the reasons given for the
lack of co-operation by the client (it is unlikely that there could be any justifiable reason
for non-co-operation), then the auditor consider the possibility of fraud and review their
audit procedures accordingly.

Confirmation of Trade Receivables
The confirmation of trade receivables is typical of the confirmation process. Indeed
confirmation of credit customers became a standard audit procedure as a result of the
McKesson and Robbins case in the United States in the 1930’s. Highly reliable
independent audit evidence can be obtained from cirularising a sample of the client’s
credit customers for direct confirmation.
Confirmations may be of two types:
positive and negative.
– A positive confirmation requests the customer to confirm an account balance
stated on the confirmation form or designate a different amount with an
explanation. A second type of positive confirmation, often called a blank
confirmation request does not state the amount on the confirmation but
requests the customer to fill in the balance or furnish other information. It should
be noted that using this second type of positive confirmation may result in lower
response rates because additional work is required of the customers.

– A negative confirmation requests the customer to reply to the auditor only if they
disagree with the account balance stated.

Positive confirmations are generally considered to be more reliable as the customer is
requested to respond irrespective as to whether the amount stated is accurate or
inaccurate. In the case of negative confirmations, failure to respond by customers is
viewed as an accurate response, even though the customer may have chosen to ignore
the confirmation request. Despite this disadavantage negative confirmations are less
expensive because there are no follow-up procedures for non-responses, and therefore
more can be despatched for the same total cost.
Deciding which type to send is a matter of judgement for the individual auditor.

Generallynegative confirmations are only sent in the following circumstances:
– Trade receivables is made up of a large number of small accounts
– Inherent risk and control risk is assessed as low
– There is no reason to suspect that customers are unlikely to respond
In some audits a combination of negative and positive confirmations are sent; the latter
to accounts with large balances and the former to those with small balances.
Timing
The most reliable evidence from confirmations is obtained when sent as close to the
year end date as possible, as opposed to confirming the balances several months before
the balance sheet date. When this is the case, the customer’s account balances are
tested directly, without making any inferences about the transactions taking place
between the confirmation date and the year end. However, sometimes in order to
faciliate the timely completion of the audit, it can become necessary to confirm the
accounts at an interim date. This is acceptable if internal controls are adequate and can
provide reasonable assurance that sales, sales returns and cash receipts are properly
recorded between the date of the confirmation and the period end.
Sample Size
In order to select the sample of customers to be confirmed a number of factors need to
be considered:
– Materiality
– Inherent risk (size of total trade receivables balance, number of accounts, prior year
results, the risk of material misstatement)
– Control risk
– The extent and results of substantive analytical procedures and other tests of
transactions and details
– Type of confirmation used – negative normally requires a larger sample size Selection of the Items for Testing
Some type of stratification of the total population of credit customers is generally
involved. It is usual to stratify according to the monetary size of individual accounts and
the age of outstanding balances. The emphasis should be on confirming large and old
accounts because these are most likely to include a material misstatement. However, it
is important to sample some items from every material stratum of the population.

Bank-confirmations

Trade-payables-confirmation

Following up non-responses
When negative confirmations are used it is assumed that the amounts stated in
confirmations not returned are accurate. When no response has been received after the
second (or third) positive confirmation request to a customer, auditors should perform
alternative procedures. The two main alternative procedures are examining subsequent
collections and vouching unpaid invoices and supporting documentation comprising
customer balances.

Analysis of Differences
When confirmations are returned to the auditor, it is necessary to determine the reason
for any reported differences. In many cases these will result from timing differences
between the client’s and customer’s records. However, these may also indicate errors in
the client’s accounts. The most common differences are:
– Payment has already been made
– Goods have not been received
– Goods have been returned
– Clerical errors and disputed amounts
Drawing conclusions
When all differences found in the sample of responses, including those discovered in
performing alternative procedures, have been explained the auditor needs to:
– Reevaluate internal control
– Generalise from the sample to the entire population of trade receivables
– Evaluate the qualitative nature of the misstatements found in the sample,
irrespective of the monetary amount of the projected misstatement
– Determine whether sufficient evidence has been obtained regarding the
assertions being tested

Other confirmations
If inventory, which is material to the financial statement, is held under custody and
control of third party, ISA 501 (para 8) requires that the auditor “request confirmation
from the third party as to the quantities and condition of inventory held on behalf of
the entity”
– If investments are held by a third party, normally independent, reliable authorised
custodians, on behalf of the client direct confirmation from the third party should be
obtained
– If loans are made by client to third parties direct confirmation should be obtained
from the borrower
– The auditor may also request confirmation of the terms of agreements or
transactions a client has with third parties; the confirmation is designed to ask if any
amendments have been made to the agreement and what the relevant details are.