The Confirmation Process 1897

AU Section 330
The Confirmation Process
(Supersedes section 331.03.08.)
Source: SAS No. 67.
Effective for audits of fiscal periods ending after June 15, 1992, unless
otherwise indicated.

Introduction and Applicability

.01 This section provides guidance about the confirmation process in au-
dits performed in accordance with generally accepted auditing standards. This
section

Defines the confirmation process (see paragraph .04).

Discusses the relationship of confirmation procedures to the auditor's

assessment of audit risk (see paragraphs .05 through .10).

Describes certain factors that affect the reliability of confirmations (see

paragraphs .16 through .27).

Provides guidance on performing alternative procedures when re-

sponses to confirmation requests are not received (see paragraphs .31
and .32).

Provides guidance on evaluating the results of confirmation procedures

(see paragraph .33).

Specifically addresses the confirmation of accounts receivable and su-

persedes section 331, Inventories, paragraphs .03.08 and the portion
of section 331.01 that addresses the confirmation of receivables (see
paragraphs .34 and .35). This section does not supersede the portion
of section 331.01 that addresses the observation of inventories.
.02 This section does not address the extent or timing of confirmation pro-
cedures. Guidance on the extent of audit procedures (that is, considerations
involved in determining the number of items to confirm) is found in section
350, Audit Sampling, and section 312, Audit Risk and Materiality in Conduct-
ing an Audit. Guidance on the timing of audit procedures is included in section
318, Performing Audit Procedures in Response to Assessed Risks and Evaluat-
ing the Audit Evidence Obtained. [Revised, March 2006, to reflect conforming
changes necessary due to the issuance of Statement on Auditing Standards
No. 110.]
.03 In addition, this section does not address matters described in section
336, Using the Work of a Specialist, or in section 337, Inquiry of a Client's Lawyer
Concerning Litigation, Claims, and Assessments.

Definition of the Confirmation Process

.04 Confirmation is the process of obtaining and evaluating a direct
communication from a third party in response to a request for information

AU 330.04
1898 The Standards of Field Work

about a particular item affecting financial statement assertions. The process

includes
Selecting items for which confirmations are to be requested.
Designing the confirmation request.
Communicating the confirmation request to the appropriate third
party.
Obtaining the response from the third party.
Evaluating the information, or lack thereof, provided by the third
party about the audit objectives, including the reliability of that
information.

Relationship of Confirmation Procedures to the

Auditors Assessment of Audit Risk
.05 Section 312 discusses the audit risk model. It describes the concept of
assessing inherent and control risks, determining the acceptable level of de-
tection risk, and designing an audit program to achieve an appropriately low
level of audit risk. The auditor uses the audit risk assessment in determin-
ing the audit procedures to be applied, including whether they should include
confirmation.
.06 Confirmation is undertaken to obtain evidence from third parties about
financial statement assertions made by management. Section 326, Audit Ev-
idence, states that, in general, it is presumed that "Audit evidence is more
reliable when it is obtained from knowledgeable independent sources outside
the entity." [Revised, March 2006, to reflect conforming changes necessary due
to the issuance of Statement on Auditing Standards No. 106.]
.07 The greater the combined assessed level of inherent and control risk,
the greater the assurance that the auditor needs from substantive tests related
to a financial statement assertion. Consequently, as the combined assessed
level of inherent and control risk increases, the auditor designs substantive
tests to obtain more or different evidence about a financial statement asser-
tion. In these situations, the auditor might use confirmation procedures rather
than or in conjunction with tests directed toward documents or parties within
the entity.
.08 Unusual or complex transactions may be associated with high levels
of inherent risk and control risk. If the entity has entered into an unusual or
complex transaction and the combined assessed level of inherent and control
risk is high, the auditor should consider confirming the terms of the transaction
with the other parties in addition to examining documentation held by the
entity. For example, if the combined assessed level of inherent and control risk
over the occurrence of revenue related to an unusual, year-end sale is high, the
auditor should consider confirming the terms of that sale.
.09 The auditor should assess whether the evidence provided by confirma-
tions reduces audit risk for the related assertions to an acceptably low level.
In making that assessment, the auditor should consider the materiality of the
account balance and his or her inherent and control risk assessments. When
the auditor concludes that evidence provided by confirmations alone is not suf-
ficient, additional procedures should be performed. For example, to achieve an
appropriately low level of audit risk related to the completeness and existence
assertions for accounts receivable, an auditor may perform sales cutoff tests in
addition to confirming accounts receivable.

AU 330.05
 The Confirmation Process 1899
.10 The lower the combined assessed level of inherent and control risk,
the less assurance the auditor needs from substantive tests to form a con-
clusion about a financial statement assertion. Consequently, as the combined
assessed level of inherent and control risk decreases for a particular assertion,
the auditor may modify substantive tests by changing their nature from more
effective (but costly) tests to less effective (and less costly) tests. For example,
if the combined assessed level of inherent and control risk over the existence
of cash is low, the auditor might limit substantive procedures to inspecting
client-provided bank statements rather than confirming cash balances.

Assertions Addressed by Confirmations

.11 For the audit evidence obtained to be appropriate, it must be reliable
and relevant. Factors affecting the reliability of confirmations are discussed
in paragraphs .16 through .27. The relevance of audit evidence depends on its
relationship to the financial statement assertion being addressed. Section 326
classifies financial statement assertions into five categories:
a. Existence or occurrence
b. Completeness
c. Rights and obligations
d. Valuation or allocation
e. Presentation and disclosure
.12 Confirmation requests, if properly designed by the auditor, may ad-
dress any one or more of those assertions. However, confirmations do not ad-
dress all assertions equally well. Confirmation of goods held on consignment
with the consignee would likely be more effective for the existence and the
rights-and-obligations assertions than for the valuation assertion. Accounts
receivable confirmations are likely to be more effective for the existence asser-
tion than for the completeness and valuation assertions. Thus, when obtaining
evidence for assertions not adequately addressed by confirmations, auditors
should consider other audit procedures to complement confirmation procedures
or to be used instead of confirmation procedures.
.13 Confirmation requests can be designed to elicit evidence that addresses
the completeness assertion: that is, if properly designed, confirmations may
provide evidence to aid in assessing whether all transactions and accounts that
should be included in the financial statements are included. Their effective-
ness in addressing the completeness assertion depends, in part, on whether the
auditor selects from an appropriate population for testing. For example, when
using confirmations to provide evidence about the completeness assertion for
accounts payable, the appropriate population might be a list of vendors rather
than the amounts recorded in the accounts payable subsidiary ledger.
.14 Some confirmation requests are not designed to elicit evidence regard-
ing the completeness assertion. For example, the AICPA Standard Form to
Confirm Account Balance Information With Financial Institutions is designed
to substantiate information that is stated on the confirmation request; the form
is not designed to provide assurance that information about accounts not listed
on the form will be reported.

The Confirmation Process

.15 The auditor should exercise an appropriate level of professional skep-
ticism throughout the confirmation process (see section 230, Due Professional

AU 330.15
1900 The Standards of Field Work

Care in the Performance of Work). Professional skepticism is important in de-

signing the confirmation request, performing the confirmation procedures, and
evaluating the results of the confirmation procedures.

Designing the Confirmation Request

.16 Confirmation requests should be tailored to the specific audit objec-
tives. Thus, when designing the confirmation requests, the auditor should con-
sider the assertion(s) being addressed and the factors that are likely to affect
the reliability of the confirmations. Factors such as the form of the confirmation
request, prior experience on the audit or similar engagements, the nature of the
information being confirmed, and the intended respondent should affect the de-
sign of the requests because these factors have a direct effect on the reliability
of the evidence obtained through confirmation procedures.

Form of Confirmation Request

.17 There are two types of confirmation requests: the positive form and the
negative form. Some positive forms request the respondent to indicate whether
he or she agrees with the information stated on the request. Other positive
forms, referred to as blank forms, do not state the amount (or other information)
on the confirmation request, but request the recipient to fill in the balance or
furnish other information.
.18 Positive forms provide audit evidence only when responses are received
from the recipients; nonresponses do not provide audit evidence about the fi-
nancial statement assertions being addressed.
.19 Since there is a risk that recipients of a positive form of confirmation
request with the information to be confirmed contained on it may sign and
return the confirmation without verifying that the information is correct, blank
forms may be used as one way to mitigate this risk. Thus, the use of blank
confirmation requests may provide a greater degree of assurance about the
information confirmed. However, blank forms might result in lower response
rates because additional effort may be required of the recipients; consequently,
the auditor may have to perform more alternative procedures.
.20 The negative form requests the recipient to respond only if he or she
disagrees with the information stated on the request. Negative confirmation
requests may be used to reduce audit risk to an acceptable level when (a) the
combined assessed level of inherent and control risk is low, (b) a large num-
ber of small balances is involved, and (c) the auditor has no reason to believe
that the recipients of the requests are unlikely to give them consideration. For
example, in the examination of demand deposit accounts in a financial insti-
tution, it may be appropriate for an auditor to include negative confirmation
requests with the customers' regular statements when the combined assessed
level of inherent and control risk is low and the auditor has no reason to believe
that the recipients will not consider the requests. The auditor should consider
performing other substantive procedures to supplement the use of negative
confirmations.
.21 Negative confirmation requests may generate responses indicating
misstatements, and are more likely to do so if the auditor sends a large num-
ber of negative confirmation requests and such misstatements are widespread.
The auditor should investigate relevant information provided on negative
confirmations that have been returned to the auditor to determine the ef-
fect such information may have on the audit. If the auditor's investigation

AU 330.16
 The Confirmation Process 1901
of responses to negative confirmation requests indicates a pattern of mis-
statements, the auditor should reconsider his or her combined assessed level
of inherent and control risk and consider the effect on planned audit proce-
dures.
.22 Although returned negative confirmations may provide evidence about
the financial statement assertions, unreturned negative confirmation requests
rarely provide significant evidence concerning financial statement assertions
other than certain aspects of the existence assertion. For example, negative
confirmations may provide some evidence of the existence of third parties if
they are not returned with an indication that the addressees are unknown.
However, unreturned negative confirmations do not provide explicit evidence
that the intended third parties received the confirmation requests and verified
that the information contained on them is correct.

Prior Experience
.23 In determining the effectiveness and efficiency of employing confirma-
tion procedures, the auditor may consider information from prior years' audits
or audits of similar entities. This information includes response rates, knowl-
edge of misstatements identified during prior years' audits, and any knowledge
of inaccurate information on returned confirmations. For example, if the auditor
has experienced poor response rates to properly designed confirmation requests
in prior audits, the auditor may instead consider obtaining audit evidence from
other sources.

Nature of Information Being Confirmed

.24 When designing confirmation requests, the auditor should consider the
types of information respondents will be readily able to confirm, since the na-
ture of the information being confirmed may directly affect the competence of
the evidence obtained as well as the response rate. For example, certain respon-
dents' accounting systems may facilitate the confirmation of single transactions
rather than of entire account balances. In addition, respondents may not be able
to confirm the balances of their installment loans, but they may be able to con-
firm whether their payments are up-to-date, the amount of the payment, and
the key terms of their loans.
.25 The auditor's understanding of the client's arrangements and transac-
tions with third parties is key to determining the information to be confirmed.
The auditor should obtain an understanding of the substance of such arrange-
ments and transactions to determine the appropriate information to include on
the confirmation request. The auditor should consider requesting confirmation
of the terms of unusual agreements or transactions, such as bill and hold sales,1
in addition to the amounts. The auditor also should consider whether there may
be oral modifications to agreements, such as unusual payment terms or liberal
rights of return. When the auditor believes there is a moderate or high degree of
risk that there may be significant oral modifications, he or she should inquire
about the existence and details of any such modifications to written agree-
ments. One method of doing so is to confirm both the terms of the agreements
and whether any oral modifications exist.

Respondent
.26 The auditor should direct the confirmation request to a third party who
the auditor believes is knowledgeable about the information to be confirmed.

1
Bill and hold sales are sales of merchandise that are billed to customers before delivery and are
held by the entity for the customers.

AU 330.26
1902 The Standards of Field Work

For example, to confirm a client's oral and written guarantees with a fi-
nancial institution, the auditor should direct the request to a financial in-
stitution official who is responsible for the financial institution's relation-
ship with the client or is knowledgeable about the transactions or arrange-
ments.

.27 If information about the respondent's competence, knowledge, moti-

vation, ability, or willingness to respond, or about the respondent's objectivity
and freedom from bias with respect to the audited entity 2 comes to the au-
ditor's attention, the auditor should consider the effects of such information
on designing the confirmation request and evaluating the results, including
determining whether other procedures are necessary. In addition, there may
be circumstances (such as for significant, unusual year-end transactions that
have a material effect on the financial statements or where the respondent is
the custodian of a material amount of the audited entity's assets) in which the
auditor should exercise a heightened degree of professional skepticism rela-
tive to these factors about the respondent. In these circumstances, the auditor
should consider whether there is sufficient basis for concluding that the confir-
mation request is being sent to a respondent from whom the auditor can expect
the response will provide meaningful and appropriate audit evidence.

Performing Confirmation Procedures

.28 During the performance of confirmation procedures, the auditor should
maintain control over the confirmation requests and responses. Maintaining
control3 means establishing direct communication between the intended re-
cipient and the auditor to minimize the possibility that the results will be
biased because of interception and alteration of the confirmation requests or
responses.

.29 There may be situations in which the respondent, because of timeli-

ness or other considerations, responds to a confirmation request other than
in a written communication mailed to the auditor. When such responses are
received, additional evidence may be required to support their validity. For
example, facsimile responses involve risks because of the difficulty of ascer-
taining the sources of the responses. To restrict the risks associated with fac-
simile responses and treat the confirmations as valid audit evidence, the audi-
tor should consider taking certain precautions, such as verifying the source
and contents of a facsimile response in a telephone call to the purported
sender. In addition, the auditor should consider requesting the purported
sender to mail the original confirmation directly to the auditor. Oral confir-
mations should be documented in the workpapers. If the information in the
oral confirmations is significant, the auditor should request the parties in-
volved to submit written confirmation of the specific information directly to the
auditor.

.30 When using confirmation requests other than the negative form, the
auditor should generally follow up with a second and sometimes a third request
to those parties from whom replies have not been received.

2
Section 334, Related Parties, paragraphs .09 and .10, provide guidance on examining related-
party transactions that have been identified by the auditor.
3
The need to maintain control does not preclude the use of internal auditors in the confirmation
process. Section 322, The Auditor's Consideration of the Internal Audit Function in an Audit of Finan-
cial Statements, provides guidance on considering the work of internal auditors and on using internal
auditors to provide direct assistance to the auditor.

AU 330.27
 The Confirmation Process 1903

Alternative Procedures
.31 When the auditor has not received replies to positive confirmation re-
quests, he or she should apply alternative procedures to the nonresponses to
obtain the evidence necessary to reduce audit risk to an acceptably low level.
However, the omission of alternative procedures may be acceptable (a) when
the auditor has not identified unusual qualitative factors or systematic charac-
teristics related to the nonresponses, such as that all nonresponses pertain to
year-end transactions, and (b) when testing for overstatement of amounts, the
nonresponses in the aggregate, when projected as 100 percent misstatements
to the population and added to the sum of all other unadjusted differences,
would not affect the auditor's decision about whether the financial statements
are materially misstated.

.32 The nature of alternative procedures varies according to the account

and assertion in question. In the examination of accounts receivable, for ex-
ample, alternative procedures may include examination of subsequent cash
receipts (including matching such receipts with the actual items being paid),
shipping documents, or other client documentation to provide evidence for the
existence assertion. In the examination of accounts payable, for example, alter-
native procedures may include examination of subsequent cash disbursements,
correspondence from third parties, or other records to provide evidence for the
completeness assertion.

Evaluating the Results of Confirmation Procedures

.33 After performing any alternative procedures, the auditor should eval-
uate the combined audit evidence provided by the confirmations and the al-
ternative procedures to determine whether sufficient audit evidence has been
obtained about all the applicable financial statement assertions. In performing
that evaluation, the auditor should consider (a) the reliability of the confirma-
tions and alternative procedures; (b) the nature of any exceptions, including
the implications, both quantitative and qualitative, of those exceptions; (c) the
audit evidence provided by other procedures; and (d) whether additional audit
evidence is needed. If the combined audit evidence provided by the confirma-
tions, alternative procedures, and other procedures is not sufficient, the auditor
should request additional confirmations or extend other tests, such as tests of
details or analytical procedures.

Confirmation of Accounts Receivable

.34 For the purpose of this section, accounts receivable means

a. The entity's claims against customers that have arisen from the sale
of goods or services in the normal course of business, and
b. A financial institution's loans.
Confirmation of accounts receivable is a generally accepted auditing procedure.
As discussed in paragraph .06, it is generally presumed that evidence obtained
from third parties will provide the auditor with higher-quality audit evidence
than is typically available from within the entity. Thus, there is a presumption
that the auditor will request the confirmation of accounts receivable during an
audit unless one of the following is true:

Accounts receivable are immaterial to the financial statements.

AU 330.34
1904 The Standards of Field Work

The use of confirmations would be ineffective.4

The auditor's combined assessed level of inherent and control risk is
low, and the assessed level, in conjunction with the evidence expected
to be provided by analytical procedures or other substantive tests of
details, is sufficient to reduce audit risk to an acceptably low level
for the applicable financial statement assertions. In many situations,
both confirmation of accounts receivable and other substantive tests
of details are necessary to reduce audit risk to an acceptably low level
for the applicable financial statement assertions.
.35 An auditor who has not requested confirmations in the examination of
accounts receivable should document how he or she overcame this presumption.

Effective Date
.36 This section is effective for audits of fiscal periods ending after June
15, 1992. Early application of this section is permissible.

4
For example, if, based on prior years' audit experience or on experience with similar engage-
ments, the auditor concludes that response rates to properly designed confirmation requests will be
inadequate, or if responses are known or expected to be unreliable, the auditor may determine that
the use of confirmations would be ineffective.

AU 330.35