What is an external confirmation?
ISA 505.7 requires the auditor to maintain control over confirmation requests. The auditor selects which items to confirm and prepares the requests. Responses are directed back to the audit team, not to the client. Management can help identify contact details, but the auditor sends the letters.
The process starts with a decision about whether to use confirmations at all. ISA 505.7(a) asks the auditor to determine what to confirm and with whom. For bank balances, the answer is almost always yes. For trade receivables, the decision depends on the risk assessment and the population characteristics, plus whether alternative evidence is available. ISA 505.A4 notes that confirmations for receivables provide more relevant evidence for existence than for valuation. Testing valuation usually requires a different procedure.
When the confirming party responds, ISA 505.14 requires the auditor to evaluate whether the response provides reliable and relevant evidence. When the confirming party does not respond (a non-response), ISA 505.12 requires alternative procedures. Those alternative procedures must provide the same level of assurance the confirmation was designed to provide. Checking subsequent cash receipts against invoices is the most common alternative for receivables.
Key Points
- External confirmations are one of the strongest forms of audit evidence because they come from a source independent of the entity.
- The auditor controls the confirmation process because management involvement in the selection or mailing weakens reliability.
- If the confirming party does not respond, the auditor must perform alternative procedures under ISA 505.12.
- Failure to confirm material receivables or bank balances without documenting why is a common inspection finding.
Why it matters in practice
The AFM has identified cases where the client, rather than the auditor, selected the receivables to be confirmed or controlled the mailing of confirmation requests. ISA 505.7 is explicit: the auditor maintains control over the entire process. Allowing management to influence the selection or the despatch undermines the independence of the evidence.
Teams sometimes accept a low confirmation response rate without performing adequate alternative procedures. ISA 505.12 does not permit the auditor to skip alternative procedures because the non-response is "expected" for the industry. If the confirmation was worth sending, the non-response is worth investigating.
Worked example: Fournier Holding S.A.
Client: Belgian holding company, FY2024, revenue €85M, IFRS reporter, five subsidiaries across Belgium, France, Luxembourg, and the Netherlands. The team selects the top 15 trade receivable balances (representing €22M of the €31M receivable ledger) and all four bank relationships. Two intercompany balances of €6M and €4.2M with French subsidiaries are also selected.
The auditor prepares positive confirmation requests, addressing each to the confirming party's accounts receivable department (for trade balances) or the bank's audit confirmation department. All requests include a reply-to address directed to the audit firm. By the response deadline, 12 of 15 trade receivable confirmations and all four bank confirmations are returned. Two trade confirmations show discrepancies: one of €47K (timing difference, goods in transit at year-end) and one of €112K (disputed invoice). The team investigates both.
Three trade receivable confirmations (totalling €1.8M) received no response. The team tests subsequent cash receipts against the specific invoices comprising each balance. Two of the three balances are fully supported. The remaining €320K balance is partially supported; the team extends testing to shipping documentation. The confirmation process covered 71% of the receivable ledger by value, with alternative procedures applied to all non-responses and all bank balances independently confirmed.
External confirmation vs written representations
External confirmations and written representations both produce written evidence, but from different sources with different reliability. Confirmations come from third parties independent of the entity. Representations come from management, who prepared the financial statements being audited. ISA 500.A31 ranks external confirmations higher in the evidence hierarchy because of that independence.
The practical distinction: a bank confirmation provides direct evidence of the bank balance. A management representation that "all bank accounts have been disclosed" confirms completeness but says nothing about existence or accuracy. Where an external confirmation is available and practicable, relying solely on a management representation for the same assertion is difficult to defend.
Key standard references
- ISA 505.7: The auditor must maintain control over the confirmation process, including selecting items and directing responses to the audit team.
- ISA 505.7(a): Requires the auditor to determine what to confirm and with whom.
- ISA 505.12: Requires alternative procedures when a confirming party does not respond.
- ISA 505.14: Requires the auditor to evaluate whether each response provides reliable and relevant evidence.
- ISA 505.A4: Confirmations for receivables provide more relevant evidence for existence than for valuation.
Related terms
Related reading
Frequently asked questions
Why must the auditor maintain control over the confirmation process?
ISA 505.7 requires the auditor to maintain control over confirmation requests because management involvement in the selection or mailing weakens the reliability of the evidence. If the client selects which receivables to confirm or controls the despatch, the independence of the evidence is compromised. The auditor selects the items, prepares the requests, and ensures responses are directed back to the audit team.
What happens when a confirming party does not respond?
ISA 505.12 requires the auditor to perform alternative procedures when a confirming party does not respond. Those alternative procedures must provide the same level of assurance the confirmation was designed to provide. For trade receivables, checking subsequent cash receipts against specific invoices is the most common alternative. The auditor cannot skip alternative procedures simply because a low response rate is expected for the industry.