10.2 External Confirmations: Positive, Negative & Non-Responses (AU-C 505)
Key Takeaways
- Under AU-C 330, the auditor confirms accounts receivable unless the balance is immaterial, confirmation would be ineffective, or assessed RMM is low and other substantive procedures address it.
- Positive confirmations require a response in all cases and provide persuasive evidence regarding existence and rights, but do not substantiate valuation; blank confirmations provide higher assurance against rubber-stamping but yield lower response rates.
- Negative confirmations request a response only upon disagreement and may be used exclusively when all four GAAS criteria are met: low RMM with effective controls, large volume of small homogeneous balances, very low expected exception rate, and no expectation of disregard.
- Auditors must maintain strict direct control over the confirmation process by independently verifying recipient addresses, mailing requests directly, and receiving responses directly without client interception.
- For non-responses to positive confirmations, the auditor must perform mandatory alternative procedures—specifically inspecting subsequent cash collections, shipping documents, and customer purchase orders; unjustified management refusal to confirm constitutes a scope limitation.
10.2 External Confirmations: Positive, Negative & Non-Responses (AU-C 505)
Core Principle: External confirmation is defined under AU-C 505 (External Confirmations) as audit evidence obtained as a direct written response to the auditor from a third party (the confirming party), in paper form, by electronic medium, or other medium. Under US GAAS (AU-C 330), external confirmation of trade accounts receivable is required unless one of three exceptions applies. Direct external communication provides exceptionally reliable audit evidence regarding the existence and rights assertions because third-party debtors have no inherent incentive to assist management in overstating client financial statements.
1. The GAAS External Confirmation Requirement (AU-C 330 & AU-C 505)
Under US GAAS (AU-C 330), the auditor should use external confirmation procedures for accounts receivable except when at least one of the following three conditions applies. AU-C 505 then governs how confirmation procedures are designed and performed:
+-------------------------------------------------------------------------------------------------------+
| THE THREE GAAS EXCEPTIONS TO AR CONFIRMATION |
| |
| EXCEPTION 1: IMMATERIALITY |
| The overall accounts receivable balance is immaterial to the financial statements taken as a whole. |
| |
| EXCEPTION 2: INEFFECTIVENESS |
| External confirmations would be ineffective because expected response rates are extraordinarily |
| low or unreliable (e.g., municipal/government entities with strict policies prohibiting responses, |
| or healthcare patients who fail to track third-party insurance balances). |
| |
| EXCEPTION 3: LOW RISK & SUFFICIENT ALTERNATIVE SUBSTANTIVE EVIDENCE |
| The combined assessed Risk of Material Misstatement (IR × CR) at the assertion level is LOW, |
| and other planned substantive procedures (e.g., subsequent cash receipts testing and detailed sales |
| cutoff tests) provide sufficient, appropriate audit evidence to reduce audit risk to an acceptably |
| low level. |
+-------------------------------------------------------------------------------------------------------+
Mandatory Documentation Requirement
If the auditor does not use external confirmation for accounts receivable, the auditor must document the basis for that determination (AU-C 330). Simply stating "management requested omission" or "other procedures were preferred" is an immediate violation of GAAS and will cause an audit failure during peer review or PCAOB/AICPA inspection.
2. Confirmation Types: Positive, Blank, and Negative
Auditors select between different confirmation formats depending on the assessed risk of material misstatement, population characteristics, and desired audit assurance.
+-------------------------------------------------------------------------------------------------------+
| CONFIRMATION TYPE SPECTRUM |
| |
| TYPE RECIPIENT ACTION AUDIT ASSURANCE RESPONSE RATE |
| ---- ---------------- --------------- ------------- |
| Positive Confirmation Must reply in ALL cases HIGH MODERATE TO HIGH |
| (Agree or Disagree) |
| |
| Blank Positive Form Must fill in balance owed HIGHEST LOWER |
| from internal books (Prevents Rubber- (Higher Recipient |
| Stamping) Burden) |
| |
| Negative Confirmation Replies ONLY if in LOWER PASSIVE |
| disagreement (Unreturned ≠ Valid) (No reply = Agreement)|
+-------------------------------------------------------------------------------------------------------+
1. Positive Confirmations
- Mechanism: The confirmation letter states the specific recorded dollar balance (or individual invoice details) as of the confirmation date and explicitly requests the customer to reply directly to the auditor indicating whether they agree, or stating the reasons for disagreement.
- Assertions Tested: Provides robust substantive evidence for existence, rights, and cutoff. However, positive confirmations do not provide sufficient audit evidence regarding valuation (a debtor may confirm they legally owe $100,000, but be completely insolvent and unable to pay).
- Audit Risk ("Rubber-Stamping"): The primary weakness of standard positive confirmations is that recipients may sign and return the letter without cross-checking their accounting records.
2. Blank Confirmations (Blank Positive Form)
- Mechanism: A variation of the positive confirmation where the stated dollar balance is omitted, and the debtor is requested to look up their accounting records and insert the balance owed as of the confirmation date.
- Advantage: Provides the highest degree of audit assurance among confirmation designs because the debtor cannot simply "rubber-stamp" the client's figure; they must examine their accounts payable records.
- Disadvantage: Results in a significantly lower response rate because it requires more effort from the customer's accounting staff, necessitating extensive follow-up requests and alternative procedures.
3. Negative Confirmations
- Mechanism: The confirmation request states the balance and instructs the recipient to respond only if they disagree with the reported amount.
- Inherent Weakness: The absence of a response does not guarantee that the customer received the request, verified the balance, and agreed with the amount. The customer may have discarded the letter, delivered it to an inactive office, or ignored it as junk mail.
- The Four Mandatory GAAS Conditions: Under AU-C 505.15, the auditor must not use negative confirmation requests as the sole substantive procedure unless ALL FOUR of the following criteria are satisfied simultaneously:
+-------------------------------------------------------------------------------------------------------+
| FOUR MANDATORY CRITERIA FOR NEGATIVE CONFIRMATIONS |
| |
| 1. LOW ASSESSED RMM: The combined assessed risk of material misstatement is low, and the auditor |
| has obtained sufficient appropriate audit evidence regarding the operating effectiveness of |
| relevant internal controls. |
| |
| 2. LARGE POPULATION OF SMALL BALANCES: The population comprises a large number of small, |
| homogeneous account balances or transactions (e.g., utility customers, retail store cardholders).|
| |
| 3. VERY LOW EXPECTED EXCEPTION RATE: Prior audits and current control testing indicate that billing |
| errors and disputed amounts are exceptionally rare. |
| |
| 4. NO REASON TO BELIEVE RECIPIENTS WILL DISREGARD: The auditor has no evidence or expectation that |
| the confirming parties would ignore or disregard negative confirmation requests. |
+-------------------------------------------------------------------------------------------------------+
Exam Trap: If an exam question mentions that accounts receivable contains a few large commercial balances, or that the client's internal controls are weak (control risk at maximum), or that the historical exception rate was moderate to high, negative confirmations cannot serve as the sole substantive procedure for that assertion.
Comprehensive Confirmation Comparison Matrix
| Attribute | Standard Positive Confirmation | Blank Positive Confirmation | Negative Confirmation |
|---|---|---|---|
| Customer Response | Required in all circumstances | Required in all circumstances | Required only if customer disagrees |
| Stated Balance on Form | Yes — Exact dollar balance stated | No — Customer must enter amount | Yes — Exact dollar balance stated |
| Degree of Assurance | High | Highest | Low (Implicit / Passive evidence) |
| Primary Audit Risk | Rubber-stamping without review | Very low response rates | Assuming non-responses equal agreement |
| Cost & Effort | Moderate | High (Extensive follow-ups) | Low |
| Best Used When | Individual balances are large; RMM is high or controls untested | High fraud risk; suspect client overstatement | All 4 GAAS criteria met (e.g., utility accounts) |
3. Maintaining Strict Auditor Control Over the Process
Under AU-C 505.07, the auditor must maintain direct control over the entire confirmation process from inception to completion. Any client interference compromises the objectivity of the evidence.
AUDITOR DIRECT CONTROL PROTOCOL
[1. DIRECT SELECTION] Auditor independently selects sample accounts from the A/R subledger.
| (Client personnel are NEVER permitted to select or substitute accounts).
v
[2. ADDRESS AUDIT] Auditor independently verifies customer mailing and email addresses.
| (Cross-reference to corporate directories, secretary of state filings).
v
[3. DIRECT MAILING] Auditor directly deposits confirmation requests into the postal stream
| or transmits through a secure confirmation platform. (No client handling).
v
[4. DIRECT RETURN] Confirmation envelopes must contain the AUDITOR'S return address and
direct reply instructions to the auditor's physical or electronic portal.
Direct Control Vulnerabilities and Safeguards
- Verifying Mailing Addresses: Management attempting fraud may supply fictitious customer addresses (e.g., an employee's home address or an accomplice's P.O. Box). The auditor must independently verify customer addresses using external business directories, corporate state filings, or credit reporting agency databases.
- Direct Mailing and Return: The confirmation letters must be signed by client management (authorizing disclosure of financial information), but the auditor must personally mail the letters. Client employees must never be allowed to collect, post, or mail confirmation letters.
- Validating Electronic Confirmations:
- Confirmations sent via third-party digital platforms (e.g., Confirmation.com) are acceptable provided the platform has established encryption, user identity validation, and SOC 1/SOC 2 reporting.
- Responses received by email or fax carry added reliability risk. When doubts arise, the auditor may verify the source, for example by calling the confirming party at an independently obtained phone number (not one printed on the response).
4. Investigating Exceptions: Timing Differences vs. True Misstatements
When a confirming party replies indicating a balance different from the client's records, the auditor must investigate the root cause of the discrepancy. Not every confirmation exception represents an audit misstatement.
+-------------------------------------------------------------------------------------------------------+
| CONFIRMATION EXCEPTION RESOLUTION PROTOCOL |
| |
| CONFIRMATION EXCEPTION REPORTED |
| ------------------------------- |
| | |
| +-----------------------------------+ |
| | | |
| v v |
| [TIMING DIFFERENCES] [ACTUAL AUDIT MISSTATEMENTS] |
| - Goods in transit (FOB Shipping) - Cutoff errors (FOB Destination) |
| - Payments in transit (Mailed check) - Pricing / Clerical billing errors |
| - Normal processing lag - Fictitious shipments / early billing |
| | - Unrecorded returns / disputes |
| v | |
| Verify post-year-end delivery v |
| or bank deposit; Project misstatement to population; |
| NO adjustment required. Propose audit adjusting journal entry. |
+-------------------------------------------------------------------------------------------------------+
Detailed Analysis of Common Exceptions
| Reported Customer Exception | Audit Investigation Steps | Audit Determination | Accounting Action |
|---|---|---|---|
| "We paid this invoice of $45,000 on Dec 28 (Check #1042)." | Trace check #1042 to client's January bank statements, deposit slips, and cash receipts journal. | Payment in Transit (Timing Difference): Client received and deposited check on Jan 3. | No misstatement as of Dec 31. Balance was legitimately open at year-end. |
| "We did not receive these goods ($30,000) until Jan 4." | Inspect bill of lading for shipping terms and shipping date. Terms were FOB Destination, shipped Dec 29. | Cutoff Misstatement: Title did not pass until delivery on Jan 4. | Propose adjustment: Reverse revenue and A/R; restore inventory at cost. |
| "We did not receive these goods ($30,000) until Jan 4." | Inspect bill of lading for shipping terms and shipping date. Terms were FOB Shipping Point, shipped Dec 30. | Goods in Transit (Timing Difference): Title passed on Dec 30 upon carrier delivery. | No misstatement. Revenue and receivable properly recorded in December. |
| "We returned this merchandise ($18,000) on Dec 22 because it was defective." | Inspect receiving reports and warehouse logs around Dec 22. Goods were physically received on Dec 24, but credit memo was delayed until Jan 8. | Actual Misstatement: Failure to record sales return and credit memo in December. | Propose adjustment: Debit Sales Returns and credit Accounts Receivable in December. |
| "Our contract price is $80/unit, but we were billed at $100/unit ($20,000 difference)." | Examine approved customer contract, sales order, and master price list. Billing clerk entered incorrect unit price. | Clerical / Pricing Misstatement: Invoicing calculation error. | Propose adjustment: Reduce revenue and accounts receivable by $20,000. |
5. Managing Non-Responses: Follow-Ups and Mandatory Alternative Procedures
When positive confirmation requests are not returned by customers, the auditor cannot simply treat the account as "audited" or assume the client's records are correct.
Non-Response Action Protocol
- Send Second and Third Confirmation Requests: The auditor should issue follow-up requests. Management may assist by calling the customer and encouraging them to complete the auditor's confirmation letter, but the response must be returned directly to the auditor.
- Mandatory Alternative Procedures: Under AU-C 505.12, if positive confirmations are not returned after reasonable follow-up efforts, the auditor must perform alternative substantive procedures on every non-responding account.
+-------------------------------------------------------------------------------------------------------+
| MANDATORY ALTERNATIVE PROCEDURES (AU-C 505) |
| |
| 1. SUBSEQUENT CASH COLLECTIONS TESTING (Highest Assurance) |
| Inspect client bank statements, remittance advices, and deposit slips in January and February to |
| verify that the customer paid the specific open year-end invoice after the balance sheet date. |
| |
| 2. INSPECTION OF SHIPPING DOCUMENTATION |
| Vouch the recorded sale to prenumbered bills of lading, freight bills, and carrier tracking logs |
| confirming physical shipment of goods prior to year-end. |
| |
| 3. INSPECTION OF CUSTOMER PURCHASE ORDERS & CONTRACTS |
| Examine signed customer contracts, purchase orders, and credit approval documentation proving |
| the customer placed a legitimate, binding order. |
+-------------------------------------------------------------------------------------------------------+
When a Positive Response Is Essential
AU-C 505 requires alternative procedures for each nonresponse. If the auditor concludes that a response to a positive confirmation request is necessary to obtain sufficient appropriate evidence (for example, because of a fraud risk or suspected side agreements), alternative procedures will not substitute, and a missing response requires the auditor to determine the effect on the audit and the opinion. In a sampling application, a selected item that cannot be supported by a response or by alternative procedures is treated as a misstatement when the sample is evaluated (AU-C 530).
6. Management Refusal to Permit External Confirmations
Occasionally, client management requests that the auditor refrain from sending confirmation requests to specific customers or the entire accounts receivable population (e.g., claiming ongoing legal disputes, delicate contract renegotiations, or customer relationship concerns).
Auditor's Required Protocol Under AU-C 505.08–.09
- Inquire Regarding Management's Reasons: The auditor must inquire about the specific reasons for management's refusal and seek corroborating audit evidence to evaluate whether the reasons are valid and reasonable.
- Assess Implications on Fraud and RMM: The auditor must evaluate whether the refusal represents an attempt to conceal fictitious receivables, fraudulent sales cutoff, or side agreements, and revise the assessed risk of material misstatement.
- Perform Alternative Procedures: Attempt to obtain sufficient, appropriate audit evidence through alternative substantive procedures (subsequent collections, shipping records, customer contracts).
+-------------------------------------------------------------------------------------------------------+
| MANAGEMENT REFUSAL RESOLUTION PATHWAY |
| |
| MANAGEMENT REFUSES TO ALLOW CONFIRMATION |
| ---------------------------------------- |
| | |
| +-----------------------------------+ |
| | | |
| v v |
| [REASON IS VALID & REASONABLE] [REASON IS UNREASONABLE / FRAUD SUSPECTED] |
| (e.g., active formal litigation) - Communicate with Governance (Audit Committee) |
| | - Evaluate implications for Audit Opinion: |
| v * SCOPE LIMITATION: Qualified or Disclaimer of Opinion |
| Perform Alternative Procedures - Consider withdrawal from engagement |
| (Subsequent cash, shipping docs) |
| | |
| Sufficient Evidence Obtained? |
| YES --> Unmodified Opinion |
| NO --> Scope Limitation (Qualified) |
+-------------------------------------------------------------------------------------------------------+
Exam Trap: If management refuses to allow confirmations without a valid, justifiable reason, or if management prevents the auditor from performing alternative procedures, this constitutes a client-imposed limitation on audit scope. The auditor must communicate with Those Charged With Governance (the Audit Committee) and either issue a Qualified Opinion (if material but not pervasive) or a Disclaimer of Opinion (if material and pervasive), or consider withdrawing from the engagement.
Standards Watch: Issuer Audits and SAS No. 150
- PCAOB AS 2310 (issuer audits): Replaced in 2023 and effective for audits of fiscal years ending on or after June 15, 2025. It addresses confirming cash held by third parties and accounts receivable, and it describes what the auditor does when confirmation is not feasible.
- AICPA SAS No. 150 (nonissuers): Amends AU-C 330 and AU-C 505, including a requirement to confirm cash and cash equivalents held by third parties when a risk of material misstatement exists. It is effective for periods ending on or after December 15, 2028, so it is not yet eligible for CPA Exam testing.
Under AU-C 505, an auditor is considering utilizing negative confirmation requests for substantive testing of trade accounts receivable. Which scenario satisfies all four mandatory GAAS criteria for the use of negative confirmations?
An auditor sends a positive confirmation for a recorded accounts receivable balance of $85,000 as of December 31. The customer returns the confirmation stating: 'Our records show we owed $60,000 as of December 31 because we mailed check #4092 for $25,000 on December 29.' What audit procedure should the auditor perform next to resolve this difference?
An auditor selects a sample of 60 customer accounts for positive confirmation. After sending initial requests and second requests, 8 customers with aggregate balances of $420,000 do not respond. What is the auditor's required action under AU-C 505?
During the audit of accounts receivable, client management requests that the auditor not confirm balances with three specific major customers, claiming that confirmation requests might disrupt ongoing sensitive contract renegotiations. What is the auditor's primary responsibility in addressing this situation?