External confirmation is one of the most familiar audit procedures, but a confirmation request is not a substitute for audit judgement. Under ICAI's SA 505, External Confirmations, the auditor controls the confirmation process and evaluates whether responses provide relevant and reliable audit evidence. The procedure is commonly used for receivables, bank balances, borrowings, payables and other balances where evidence from an independent third party can strengthen the audit conclusion.
What is an external confirmation?
An external confirmation is audit evidence obtained as a direct written response to the auditor from a third party, in paper, electronic or another medium. The key feature is independence of the source. A ledger printout supplied by management is internal evidence; a response received directly from the bank or customer through a controlled confirmation process is external evidence.
ICAI's SA 500, Audit Evidence explains the wider principle: audit evidence must be sufficient and appropriate, and reliability is influenced by its source and nature. External confirmations therefore sit within the broader evidence strategy rather than operating as an isolated checklist item.
Positive and negative confirmations
A positive confirmation asks the confirming party to reply in all cases, either agreeing with the information stated or providing the requested information. SA 505 notes that a positive response ordinarily provides reliable audit evidence, although the auditor must still consider whether the respondent actually verified the information.
A negative confirmation asks the party to respond only if it disagrees. This provides less persuasive evidence because silence does not prove that the recipient received, read and agreed with the request. SA 505 therefore permits negative confirmations as the sole substantive procedure only when specified conditions are met, including low assessed risk, a large population of small homogeneous balances, a very low expected exception rate and no reason to believe recipients will ignore the request.
Why the auditor must control the process
The reliability of confirmation evidence depends heavily on control over the request. SA 505 requires the auditor to determine the information to be confirmed, select the appropriate confirming party, design the request properly, address it correctly and send it with follow-up where applicable.
This means management should not be allowed to select only convenient customers, collect responses privately or forward unverified replies as though they came directly from the respondent. The auditor should consider the validity of addresses and the authenticity of electronic responses, especially where unusual domains, forwarded emails or other circumstances create doubt.
What if management refuses to allow a confirmation?
A management refusal is not simply an administrative inconvenience. SA 505 requires the auditor to inquire into management's reasons, evaluate whether those reasons are valid and reasonable, consider the implications for risk assessment including fraud risk, and perform alternative audit procedures designed to obtain relevant and reliable evidence.
If the refusal is unreasonable or the auditor cannot obtain sufficient appropriate evidence through alternatives, the matter can affect communication with those charged with governance and ultimately the auditor's report under the applicable auditing standards.
What if no reply is received?
Non-response does not automatically mean that the balance is misstated. The auditor may send a follow-up request and, where necessary, perform alternative procedures. The alternative procedure must respond to the assertion being tested rather than merely add paperwork to the file.
Example: trade receivable confirmation
Assume a material customer balance of ₹18 lakh is selected for positive confirmation and no response arrives after follow-up. For the existence assertion, the auditor might examine subsequent cash receipts, match those receipts to the year-end invoices, inspect sales invoices and dispatch or delivery evidence, and review correspondence for disputes or returns. If subsequent receipt covers only part of the balance, the remaining amount still requires evidence.
For a payable balance, alternative work may focus on subsequent payments, supplier invoices, goods-receipt records and correspondence. The evidence changes because the audit risk and relevant assertions differ.
How should confirmation exceptions be handled?
A difference between the books and the third-party response is not automatically an audit misstatement. It may arise from goods in transit, payments in transit, credit notes recorded in different periods, disputed invoices, cut-off errors or genuine accounting mistakes. The auditor should investigate the reason and determine whether the exception indicates a misstatement or a control problem.
Repeated exceptions can be more significant than one isolated difference. They may suggest weaknesses in cut-off, reconciliation, customer master data or dispute management and can affect the auditor's assessment of the population beyond the individual items confirmed.
Practical confirmation workflow
- Define the assertion: decide whether the procedure is intended to address existence, rights and obligations, completeness, valuation or another assertion.
- Select the population and items: link selection to assessed risk and materiality rather than choosing only large convenient balances.
- Validate respondent details: obtain and test addresses or contact information independently where appropriate.
- Design and send under auditor control: keep control over dispatch, return route and follow-up.
- Authenticate responses: investigate unusual electronic responses, altered documents or replies routed through management.
- Investigate exceptions: reconcile differences to supporting records and assess whether they indicate misstatement.
- Perform alternatives for non-responses: tailor procedures to the assertion and account balance.
- Conclude on the population: evaluate confirmation results together with other evidence rather than treating response count as the audit conclusion.
Common mistakes to avoid
- Assuming a signed confirmation is conclusive evidence without considering authenticity or respondent competence.
- Letting the client control dispatch or collect replies.
- Treating every non-response as a zero balance or every exception as a misstatement.
- Using negative confirmations merely because they are easier to administer.
- Performing generic alternative procedures that do not address the relevant assertion.
- Ignoring contradictory evidence elsewhere in the audit file. SA 500 requires the auditor to respond when evidence from different sources is inconsistent or its reliability is doubtful.
Practical takeaway
External confirmation is powerful because it can provide evidence from outside the entity, but its value depends on how the auditor designs, controls and evaluates the process. Start with the assertion and risk, maintain control over the request, authenticate responses, investigate exceptions and perform meaningful alternatives for non-responses. The objective is not to collect a target number of replies; it is to obtain sufficient appropriate evidence for the audit conclusion. ICAI's Standards on Auditing index provides the current official standards library for SA 500, SA 505 and related audit-evidence standards.
