External confirmation is one of the most useful audit procedures when the auditor needs evidence directly from a third party. Under ICAI's SA 505, External Confirmations, an external confirmation is audit evidence obtained as a direct written response to the auditor from a third party, whether on paper, electronically or through another medium. The procedure is commonly associated with bank balances and trade receivables, but its usefulness is wider: it can support evidence about loans, investments, inventory held by third parties, payables and contractual terms.
Why external confirmations can be persuasive
Confirmation evidence can be strong because it originates outside the entity and is received directly by the auditor. That does not make every confirmation automatically reliable. SA 500, Audit Evidence explains that reliability depends on the source, nature and circumstances in which evidence is obtained. Even evidence from an external source can be unreliable if the source lacks knowledge or other circumstances undermine reliability.
The practical objective is therefore not to collect confirmation letters mechanically. It is to design a procedure that addresses the relevant assertion and preserves auditor control from selection through response evaluation.
Positive and negative confirmations are different
SA 505 distinguishes between positive and negative confirmation requests. A positive request asks the confirming party to respond directly to the auditor, either agreeing or disagreeing with stated information or supplying requested information. A negative request asks for a response only when the confirming party disagrees with the information provided.
Negative confirmations provide less persuasive evidence than positive confirmations. SA 505 does not permit negative confirmation requests to be used as the sole substantive audit procedure addressing an assessed risk of material misstatement unless specified conditions are met, including low assessed risk, a large population of small homogeneous balances, a very low expected exception rate and no reason to believe recipients will disregard the requests.
The auditor must maintain control over the process
SA 505 requires the auditor to maintain control over external confirmation requests. This includes deciding what information will be confirmed, selecting the appropriate confirming party, designing the request and ensuring it is properly addressed, and sending the request and follow-up requests where applicable.
This control is central to reliability. If management chooses all recipients, sends the requests itself and receives the replies before passing selected responses to the auditor, the procedure no longer has the same evidential quality as a confirmation controlled by the auditor.
A practical confirmation workflow
- Start with the assertion. Decide whether the procedure is aimed at existence, rights and obligations, completeness, terms, valuation inputs or another assertion.
- Select the population and confirming parties. Use the risk assessment, materiality and characteristics of the population rather than confirming only convenient balances.
- Validate addresses independently. Where practical, corroborate email, postal or portal details using reliable information instead of relying only on contact details supplied for the exercise.
- Prepare and control dispatch. The auditor should control the request and ensure replies are directed to the auditor.
- Follow up non-responses. A missing reply is not evidence that the balance is correct.
- Investigate exceptions. Differences may represent timing items, errors, disputes, fraud indicators or weaknesses in the entity's records.
- Document the conclusion. Link the confirmation result and any alternative procedures to the assertion and audit conclusion.
What if management refuses to allow a confirmation?
SA 505 requires the auditor to inquire into management's reasons for refusing, seek audit evidence about whether those reasons are valid and reasonable, evaluate the effect of the refusal on the assessment of risks including fraud risk, and perform alternative audit procedures designed to obtain relevant and reliable evidence.
If the refusal is unreasonable, or the auditor cannot obtain relevant and reliable evidence through alternative procedures, SA 505 requires communication with those charged with governance and consideration of the implications for the audit and the auditor's opinion in accordance with the applicable auditing standards.
What to do when a positive confirmation receives no response
A non-response to a positive request is not a clean confirmation. SA 505 requires the auditor to perform alternative audit procedures to obtain relevant and reliable audit evidence. The appropriate alternative depends on the account and assertion being tested.
For trade receivables, alternatives may include examining subsequent cash receipts, shipping documentation and sales close to period end. For trade payables, the auditor may examine subsequent disbursements, third-party correspondence and other records. The procedure should be designed around the assertion rather than treated as a standard substitute checklist.
Example: year-end trade receivables
Assume a manufacturer has a material customer balance of Rs. 45 lakh at year end. The auditor sends a positive confirmation directly to the customer's independently validated finance contact. No reply arrives after a follow-up.
The auditor should not mark the balance as confirmed. Instead, the auditor might inspect bank records for subsequent receipts, match those receipts to the specific invoices, inspect dispatch or delivery evidence around year end, review credit notes issued after year end and investigate any customer dispute. A subsequent receipt can provide useful evidence about existence and recoverability, while dispatch testing can address cut-off. Different assertions may therefore require different evidence.
How to treat confirmation exceptions
An exception is a difference between the information requested or contained in the entity's records and the information supplied by the confirming party. SA 505 requires the auditor to investigate exceptions to determine whether they indicate misstatements.
Some exceptions are reconciling items rather than errors. A customer may have recorded a payment that was still in transit at the reporting date, or goods may have been recorded at different dates because of agreed delivery terms. But an unexplained difference can also indicate incorrect cut-off, unrecorded credit notes, disputed sales or fraud risk. The auditor should understand the cause before concluding.
Electronic replies need authenticity checks
SA 505 recognises that responses may be received electronically. Electronic responses can create risks regarding origin and authority of the respondent and the integrity of transmission. When the auditor has doubts about reliability, the standard requires further audit evidence to resolve those doubts.
In practice, teams should be alert to unusual domains, altered email chains, responses routed through client personnel, unexpected changes in contact details and replies that do not match the request. A confirmation platform can improve process control, but professional judgment about authenticity and relevance remains necessary.
External confirmation is not mandatory for every balance
SA 330, The Auditor's Responses to Assessed Risks requires the auditor to consider whether external confirmation procedures are to be performed as substantive audit procedures. The audit response should therefore arise from assessed risk, materiality, assertions and the persuasiveness of available evidence rather than from a rule that every debtor or bank account must always be confirmed in the same way.
Working-paper checklist
- Document the assertion and reason for using confirmation.
- Record how recipients and items were selected.
- Retain evidence that addresses were validated and dispatch remained under auditor control.
- Track sent, returned, undelivered and unanswered requests.
- Document follow-ups and alternative procedures for positive non-responses.
- Investigate and conclude on every material or risk-relevant exception.
- Record authenticity concerns and the additional procedures used to resolve them.
- Conclude whether the total evidence obtained is sufficient and appropriate for the assertion tested.
Practical takeaway
SA 505 is not a letter-sending exercise. A reliable external-confirmation procedure begins with the assertion, keeps the request and response under auditor control, treats non-responses and exceptions as matters requiring further work, and evaluates the reliability of every response. Used this way, confirmations can provide persuasive evidence; used mechanically, they can create a false sense of audit comfort.
