Key Points
- A positive confirmation produces evidence whether the recipient agrees or disagrees; a negative confirmation produces evidence only on disagreement.
- Non-responses to positive confirmations require follow-up and alternative procedures; non-responses to negative confirmations are treated as agreement.
- ISA 505.15 restricts negative confirmations to situations where three specific conditions are all met.
- Using negative confirmations when positive confirmations are required weakens the evidence and exposes the file to inspection findings.
Side-by-side comparison
| Dimension | Positive confirmation | Negative confirmation |
|---|---|---|
| Response required | Always, regardless of whether the recipient agrees or disagrees | Only if the recipient disagrees with the stated information |
| Non-response | None; non-response requires follow-up and alternative procedures (ISA 505.12) | Non-response is assumed to indicate agreement (ISA 505.A20) |
| Evidence strength | Strong: response provides explicit third-party evidence | Weak: absence of a response is not explicit evidence |
| When permitted | Always available as an option under ISA 505.7 | Only when all conditions in ISA 505.15 are met simultaneously |
| Follow-up | Yes, for every non-response (ISA 505.12) | No follow-up for non-responses; that is the design of the procedure |
When the distinction matters on an engagement
The practical difference comes down to what non-response means. With a positive confirmation, silence is not evidence. ISA 505.12 requires the auditor to perform alternative procedures for every non-response. With a negative confirmation, silence is treated as implicit agreement. That assumption is only valid when all conditions in ISA 505.15 are satisfied. The assessed risk of material misstatement must be low. The population must consist of a large number of small, homogeneous balances. And the auditor must have no reason to believe recipients will disregard the request.
The third condition is the one teams most frequently misjudge. If the recipients have no economic incentive to respond (because the confirmation asks them to verify a balance they owe, not one owed to them), the assumption that non-response equals agreement is unreliable. ISA 505.A21 notes that negative confirmations provide less persuasive evidence than positive confirmations precisely because the auditor cannot distinguish between a recipient who agreed and one who simply ignored the request.
Worked example: Connolly Software Ltd
Client: Irish SaaS company, FY2024, revenue €28M, IFRS reporter.
The engagement team needs to confirm trade receivables (€4.6M, 380 customer balances) for existence and accuracy. The receivables ledger contains two distinct populations.
Population A (12 enterprise customers, €3.1M): positive confirmations
The team sent positive confirmations to all 12 enterprise customers, requesting written confirmation of the balance as at 31 December 2024.
Documentation note: "Positive confirmations sent to all 12 enterprise customers, covering €3.1M of the €4.6M receivables balance. Positive confirmation selected because individual balances are material (range: €95K to €620K) and the assessed risk of misstatement for these balances is not low. Ref: ISA 505.7."
Responses received: 10 of 12. Two confirmations agreed with the recorded balance. Eight confirmed different amounts. Differences investigated: seven were timing differences (payments in transit at year-end), and one was a genuine overstatement of €14K (customer disputed an invoice). The two non-responses required alternative procedures under ISA 505.12: the team agreed the balances to subsequent cash receipts in January 2025 and to underlying sales contracts.
Population B (368 small subscription customers, €1.5M): negative confirmations
The remaining 368 balances ranged from €200 to €12K. The team assessed the risk of material misstatement for this population as low (stable subscription contracts with automated billing and consistent payment history). The population met all conditions under ISA 505.15.
Documentation note: "Negative confirmations sent to all 368 small subscription customers, covering €1.5M. Conditions in ISA 505.15 assessed and all three met: (1) risk of material misstatement assessed as low, (2) large number of small, homogeneous balances, (3) no indication recipients will disregard requests. Ref: ISA 505.15."
Result: 11 responses received, all indicating agreement. 357 non-responses treated as implicit confirmation. No exceptions noted.
If the team had sent negative confirmations to the 12 enterprise customers, the two non-responses would have been treated as agreement rather than triggering alternative procedures. The €14K overstatement found through the positive confirmation process would have gone undetected.
What reviewers get wrong
The FRC has flagged files where teams used negative confirmations without documenting that all three conditions in ISA 505.15 were met. The most common gap is the assessment of whether the risk of material misstatement for the specific population is low. Teams assess the overall account risk but do not separately assess the subpopulation to which the negative confirmations are sent. ISA 505.15(a) requires the assessment at the population level being tested, not the account level.
Teams sometimes treat a low positive confirmation response rate as acceptable without performing alternative procedures. ISA 505.12 requires alternative procedures for every non-response to a positive confirmation. A response rate of 30% with no alternative procedures for the remaining 70% means 70% of the sample has no evidence. The response rate is not a pass/fail threshold.
Key standard references
- ISA 505.7–8: Requirements for positive confirmations, including when to use them.
- ISA 505.12: Requires alternative procedures for every non-response to a positive confirmation.
- ISA 505.15: Restricts the use of negative confirmations to three specific conditions that must all be met.
- ISA 505.A20–A21: Application guidance on the limitations of negative confirmations as audit evidence.
Related terms
Related reading
Frequently asked questions
When can I use negative confirmations?
Only when all three conditions in ISA 505.15 are met simultaneously: the assessed risk of material misstatement is low, the population consists of a large number of small homogeneous balances, and the auditor has no reason to believe recipients will disregard the request.
What do I do if a positive confirmation gets no response?
ISA 505.12 requires alternative procedures for every non-response to a positive confirmation. This typically means agreeing the balance to subsequent cash receipts, underlying contracts, or other independent documentation. A low response rate with no alternative procedures means most of the sample has no evidence.
Are negative confirmations ever sufficient as the sole procedure?
They can be, but only for low-risk populations of small, homogeneous balances. For material balances or higher-risk assertions, negative confirmations alone are unlikely to provide sufficient appropriate evidence because non-response is treated as agreement without any explicit confirmation from the third party.