Negative Confirmation

What is a negative confirmation?

ISA 505.15 permits negative confirmations only when all of the following conditions are met: the auditor has assessed the risk of material misstatement as low, the population consists of a large number of small balances, a low exception rate is expected, and the auditor has no reason to believe the recipients will disregard the request. All four conditions must hold. If any one fails, negative confirmation is not appropriate.

The logic is straightforward. A non-response to a negative confirmation could mean the respondent agreed with the balance. It could also mean the respondent never received the request, received it and discarded it, received it and didn't bother checking, or was no longer at the address. ISA 505.A19 makes this explicit. The auditor cannot distinguish between these scenarios, which is why the evidential value of a non-response is limited.

In practice, negative confirmations work best for large populations of individually immaterial balances where the auditor already has strong corroborating evidence from other procedures. Retail bank deposit confirmations and utility customer account confirmations are typical use cases. For trade receivables on a standard audit engagement, negative confirmations are rarely sufficient as the sole substantive procedure because the auditor usually needs more than an absence of disagreement to conclude on existence.

Why it matters in practice

The most common error is using negative confirmations without documenting that all four ISA 505.15 conditions were met. Teams frequently assess two or three of the conditions and leave the others implicit. If the working paper does not address each condition individually, the reviewer cannot confirm the basis for the approach. ISA 505.15 requires all four conditions to hold simultaneously.

Some teams treat negative confirmations as a shortcut for receivables confirmation rather than evaluating whether positive confirmations would be more appropriate given the risk profile. ISA 505.A23 is clear that negative confirmations provide less persuasive evidence than positive confirmations. The question the file must answer is not "can we use negative confirmations" but "is the evidence from negative confirmations sufficient given the assessed risk."

Worked example: Gruber Einzelhandel GmbH

Client: Austrian retail chain, FY2024, revenue €52M, IFRS reporter, 1,400 trade receivable accounts totalling €3.8M. Only 12 accounts exceed €50K (totalling €1.1M). The remaining 1,388 accounts average €1,950 each, with the largest at €48K. The risk assessment rates trade receivables as low (stable customer base, no material disputes in the past two years, strong internal controls over credit management).

The team sends positive confirmations to the 12 accounts above €50K. For the remaining 1,388 small-balance accounts, the team evaluates the ISA 505.15 conditions: risk of material misstatement is low, the population is large with small homogeneous balances, prior year testing showed an exception rate below 1%, and the customer base consists of recurring B2B purchasers who process statements regularly.

The team sends 200 negative confirmations selected by stratified random sampling. By the deadline, 6 responses are received. Four disagree with the stated balance: two are timing differences (combined €4.2K), one is a pricing dispute of €1.8K, and the fourth is a correctly applied credit note of €2.1K not yet posted. The remaining 194 non-responses are treated as implicit confirmations. The projected misstatement of €6.1K is well below performance materiality of €104K.

Negative confirmation vs positive confirmation

The distinction is binary. A positive confirmation requires a response in all cases. A negative confirmation requires a response only on disagreement. The evidence gap between them is significant: a non-response to a positive confirmation is a red flag that triggers alternative procedures. A non-response to a negative confirmation is treated as agreement.

ISA 505.A19 warns that non-responses to negative confirmations provide less assurance because the auditor cannot know whether the recipient received the request, read it, or checked it against their records. For this reason, negative confirmations only work as a primary procedure when the four ISA 505.15 conditions are met. Where balances exceed performance materiality or the risk assessment is anything above low, the auditor defaults to positive confirmations.

Key standard references

• ISA 505.15: Permits negative confirmations only when four specific conditions are all met simultaneously.
• ISA 505.A19: Non-responses to negative confirmations do not provide the same level of evidence as responses to positive confirmations.
• ISA 505.A23: Negative confirmations provide less persuasive evidence than positive confirmations.
• ISA 505.7: The auditor determines whether to use confirmations and which form to use based on the risk assessment.
• ISA 530: Sampling principles apply when selecting items for negative confirmation from a population.

Related terms

Related reading

Frequently asked questions