External confirmation is one of the most familiar audit procedures, and one of the most often weakened in practice: the client sends the letters, replies come back through the accounts team, and a non-response is quietly filed as "no reply". SA 505, External Confirmations, as explained in ICAI's Board of Studies material, puts the auditor in charge of the whole process and sets out what to do when management objects, when a reply looks doubtful, when no reply arrives and when the reply disagrees with the books. This guide walks through each requirement with a worked receivables example.
The objective and the five definitions
The objective of the auditor, when using external confirmation procedures, is to design and perform them to obtain relevant and reliable audit evidence. SA 505 defines the terms that recur in every file:
- External confirmation: audit evidence obtained as a direct written response to the auditor from a third party (the confirming party), in paper form, or by electronic or other medium.
- Positive confirmation request: the confirming party is asked to respond directly to the auditor, indicating whether it agrees or disagrees with the information in the request, or providing the requested information.
- Negative confirmation request: the confirming party is asked to respond directly to the auditor only if it disagrees with the information provided.
- Non-response: a failure of the confirming party to respond, or fully respond, to a positive request, or a request returned undelivered.
- Exception: a response that shows a difference between the information requested to be confirmed, or contained in the entity's records, and the information provided by the confirming party.
Two consequences follow. An oral response is not an external confirmation, because it is not a direct written response to the auditor; the auditor may ask the party to reply in writing. And a ledger printout supplied by management, however detailed, is internal evidence.
Where confirmations are used
SA 505 describes confirmations as commonly used for account balances and their elements, such as bank balances, receivables, borrowings and payables. They are also used to confirm terms of agreements, contracts or transactions, and to confirm the absence of certain conditions, such as a side agreement. A positive confirmation becomes necessary when the information that would corroborate management's assertion is available only outside the entity, or when specific fraud risks mean the auditor cannot rely on internal evidence.
Keeping control of the request (paragraph 7)
When using external confirmation procedures, the auditor must keep control over the requests, including:
- determining the information to be confirmed or requested;
- selecting the appropriate confirming party;
- designing the requests, including checking that they are properly addressed and carry return information for responses to be sent directly to the auditor; and
- sending the requests, including follow-up requests where applicable.
In practice this means the audit team validates addresses and email domains independently, dispatches the requests itself and gives a return address that the entity cannot intercept. Management should not choose which customers are confirmed or forward replies as though they came from the respondent.
When management refuses (paragraphs 8 and 9)
If management refuses to allow the auditor to send a confirmation request, the auditor must inquire into management's reasons and seek evidence of their validity and reasonableness, evaluate the implications for the assessment of risks of material misstatement including fraud risk, and perform alternative audit procedures designed to obtain relevant and reliable evidence. If the refusal is unreasonable, or alternative procedures cannot provide sufficient appropriate evidence, the auditor communicates with those charged with governance and considers the effect on the audit and the opinion.
Doubts about a reply (paragraphs 10 and 11)
If the auditor identifies factors that give rise to doubts about the reliability of a response, further evidence is needed to resolve them. If a response is not reliable, the auditor evaluates the implications for the risk assessment, including fraud risk. Electronic replies carry particular risk because proof of origin and the authority of the respondent may be difficult to establish; encryption, electronic digital signatures and procedures to verify website authenticity reduce that risk. A reply forwarded by the client, sent from a free email domain, or received on unusual letterhead calls for a direct call-back to a number the auditor has sourced independently, followed by written confirmation.
Restrictive language in a reply, such as a disclaimer on its use, does not by itself make the response unreliable as audit evidence. The auditor judges whether the restriction affects the assertion being tested.
No reply received (paragraphs 12 and 13)
For each non-response the auditor performs alternative audit procedures to obtain relevant and reliable evidence. The ICAI material gives examples:
| Balance | Alternative procedures |
|---|---|
| Trade receivables | Examine specific subsequent cash receipts, shipping documentation and sales near the period-end |
| Trade payables | Examine subsequent cash disbursements, correspondence from third parties and other records such as goods received notes |
Where the auditor has decided that a response to a positive confirmation is necessary to obtain sufficient appropriate evidence, alternative procedures will not provide it. If the confirmation is not obtained, the auditor determines the implications for the audit and the auditor's opinion.
Worked example: a non-responding customer
A trade receivable of ₹18 lakh is selected for positive confirmation to test existence. No reply arrives after a follow-up request.
- Bank statements for April show ₹11.5 lakh received from the customer, matched to specific invoices outstanding at 31 March. That covers about 64% of the balance.
- The remaining ₹6.5 lakh relates to invoices dated 28 to 31 March. Signed delivery challans and transporter receipts support ₹5 lakh.
- ₹1.5 lakh is an invoice dated 31 March with no delivery evidence and no later receipt.
The ₹16.5 lakh supported by receipts and delivery evidence is adequately tested for existence. The ₹1.5 lakh is not: it may be a cut-off error or a fictitious sale, and it must be investigated, discussed with management and, if unsupported, treated as a misstatement and considered in the evaluation of misstatements and the risk of fraud in revenue.
When the reply disagrees (paragraph 14)
The auditor investigates exceptions to determine whether they indicate misstatements. Not every difference is an error.
Example: books show ₹10,00,000 due from a customer, who confirms ₹9,20,000. The ₹80,000 difference breaks down into a credit note of ₹50,000 for goods returned on 29 March but recorded on 3 April, which is a cut-off misstatement, and a payment of ₹30,000 made by the customer on 31 March and credited in the entity's bank on 2 April, which is a timing item needing no adjustment. Repeated cut-off exceptions of this kind point to a control weakness that affects the whole population, not only the items confirmed.
Negative confirmations (paragraph 15)
Silence does not prove that the recipient received, read and agreed with a negative request, so it gives less persuasive evidence. SA 505 allows negative confirmations as the sole substantive procedure for an assertion only when all four conditions are met:
- the risk of material misstatement is assessed as low and the auditor has obtained sufficient appropriate evidence on the operating effectiveness of relevant controls;
- the population consists of a large number of small, homogeneous balances, transactions or conditions;
- a very low exception rate is expected; and
- the auditor is not aware of circumstances that would cause recipients to disregard the requests.
A utility with lakhs of small retail customer deposits may meet these conditions. A manufacturer with forty dealers and a history of disputes will not.
Evaluating the evidence (paragraph 16)
The auditor evaluates whether the results of the confirmation procedures provide relevant and reliable audit evidence, or whether further evidence is needed. The conclusion rests on the combined evidence, not on the reply count.
Practical workflow for the audit file
- Define the assertion: existence, rights and obligations, completeness or valuation.
- Select items by risk and materiality, not only the largest or most convenient balances.
- Validate addresses and contacts from sources independent of management.
- Design, dispatch and follow up under audit team control, with a direct return route.
- Authenticate replies, especially electronic or forwarded ones.
- Investigate every exception and classify it as misstatement, timing difference or control finding.
- Perform alternative procedures for each non-response, tailored to the assertion.
- Record the conclusion on the population, and escalate management refusals to those charged with governance where required.
Common mistakes
- Letting the client dispatch requests or collect replies.
- Accepting an email reply without checking its origin.
- Treating an oral confirmation as sufficient.
- Treating every non-response as a nil balance, or every exception as a misstatement.
- Using negative confirmations because they are easier, without meeting all four paragraph 15 conditions.
- Running generic alternative procedures that do not address the assertion being tested.
Updated on 27 September 2026: retitled the page, linked the ICAI Board of Studies material on SA 505, and added the formal definitions, paragraph-wise requirements, oral and electronic response rules, restrictive language, the positive-confirmation-necessary case and two computed examples.
