Balance Confirmation Letter Format Under SA 505: Positive vs Negative, and What to Do on Non-Response
A balance confirmation letter is a request, sent on the entity's letterhead but controlled by the auditor, asking a debtor, creditor or bank to reply directly to the auditor about a balance or term. Under SA 505 the reply must come straight to the auditor, and every non-response needs alternative audit procedures; silence is never evidence.
Facts checked against the ICAI text of SA 505 (effective for audits of periods beginning on or after 1 April 2010) on 26 September 2026. Paragraph references below are to that text.
What does SA 505 actually require the auditor to control?
Paragraph 7 says the auditor must keep control of the whole process: what information is confirmed, who the confirming party is, how the request is designed and addressed (including return details so the reply goes directly to the auditor), and sending the request, including follow-ups. SA 505 defines an external confirmation as a direct written response to the auditor from a third party, on paper or electronically.
In practice this means the auditor selects the parties, tests that addresses are valid before dispatch (A6), and receives replies without the client touching them. A reply routed through the client is a reliability problem (A11).
Positive or negative confirmation: which should you use?
| Positive | Negative | |
|---|---|---|
| What the party does | Replies in all cases: agrees, disagrees or supplies the information | Replies only if it disagrees |
| Strength of evidence | A reply is ordinarily expected to be reliable evidence | Less persuasive; silence proves little (A23) |
| Blank form option | Yes: the balance is left blank for the party to fill in, which reduces the risk of a careless "agreed" but usually lowers response rates (A5) | Not applicable |
| Non-response | Treat as a non-response and perform alternative procedures (para 12) | Silence is not confirmation that the request was even received (A23) |
| Can it stand alone? | Yes | Not as the sole substantive procedure unless all four conditions in para 15 hold |
The four conditions in paragraph 15, all of which must be present before a negative request can be the only substantive procedure against an assessed assertion-level risk:
- Risk of material misstatement is assessed as low, and sufficient evidence of the operating effectiveness of relevant controls has been obtained.
- The population is a large number of small, homogeneous balances, transactions or conditions.
- A very low exception rate is expected.
- The auditor knows of nothing that would make recipients disregard the requests.
SA 505 also notes that negative requests to bank depositors may help test understatement but are unlikely to work for overstatement, because people rarely write in to say a balance is too high (A23). For significant debtors, creditors and banks, use positive requests.
How do the formats differ for debtors, creditors and banks?
The core is the same: entity letterhead, the confirming party's name and address, the balance as at the reporting date, a request to reply directly to the auditor at a stated address, and a reply slip.
- Debtors (trade receivables): state the balance owed to the entity at the date. Consider asking for the balance to be filled in by the party (blank form) where the risk of overstatement is high.
- Creditors (trade payables): send to suppliers, including those with nil or small year-end balances but large annual activity, since understated liabilities are the usual risk. Asking the supplier for a statement is more useful than asking it to agree a figure.
- Banks: SA 505 says the request should go to an official knowledgeable about the arrangements (A2). Ask for every account and balance, deposits and any lien, loan facilities with limits and security, guarantees and letters of credit, and items in safe custody. A balances-only request wastes the opportunity.
What does a sample balance confirmation letter look like?
Plain-text body, to be placed on the entity's letterhead:
[Date]
To,
[Name and address of debtor / creditor]
Dear Sir / Madam,
Sub: Confirmation of balance as at [date] for the audit of [Entity name]
Our auditors, [Audit firm name], are auditing our financial statements for
the year ended [date]. In connection with this audit, please confirm directly
to them the balance in your account in our books as at [date]:
Balance due [from you / to you]: Rs. [amount] [Dr / Cr]
Please sign and return the confirmation below directly to the auditors at:
[Auditor name, address, email], and not to us.
If you disagree, please give details of the difference (for example,
payments or invoices in transit) so that it can be reconciled.
Yours faithfully,
For [Entity name]
[Authorised signatory]
--------------- CONFIRMATION (to be returned to the auditor) ---------------
We confirm that the balance in our books as at [date] is
Rs. ______ [Dr / Cr]. [ ] Agreed [ ] Not agreed (details attached)
Name / Designation / Signature / Stamp / Date:
For a blank-form variant, remove the amount line and ask the party to enter its own figure. The external confirmation request template is an editable Word version built on the same mechanics, with a bank annexure.
What should you do when a party does not reply?
Paragraph 12: for each non-response, perform alternative procedures. A follow-up request after re-verifying the address is allowed (A7), and is normally the first step. If that fails, the standard's examples are:
| Account | Alternative procedures (A18) | Notes |
|---|---|---|
| Receivables | Examine specific subsequent cash receipts, shipping documentation and sales near period end | Match receipts to the specific invoices making up the balance |
| Payables | Examine subsequent cash disbursements, third-party correspondence and other records such as goods received notes | Check for unrecorded liabilities near the cut-off |
| Any | Consider whether the pattern of non-response signals an unidentified risk, including fraud (A19) | Revise the risk assessment and procedures if so |
Non-response also includes a request returned undelivered (para 3(d)). Where a positive response is the only way to get sufficient evidence, for example because corroboration exists only outside the entity or fraud risk factors like collusion prevent reliance on internal evidence, alternative procedures will not do, and failure to obtain the confirmation has implications for the opinion under SA 705 (para 13, A20).
What if management refuses to let you send confirmations?
Under paragraph 8, the auditor must ask why, and obtain evidence that the reason is valid and reasonable; evaluate the effect on the risks of material misstatement, including fraud; and perform alternative procedures. The standard gives a legal dispute or ongoing negotiation as a common reason, and warns that management may be trying to deny access to evidence that could reveal fraud or error (A8). An unreasonable refusal may itself be a fraud risk factor (A9).
If the refusal is unreasonable, or alternative procedures cannot give reliable evidence, paragraph 9 requires communication with those charged with governance under SA 260 (Revised) and a determination of the effect on the opinion under SA 705 (Revised).
How do you judge whether a response is reliable?
Paragraph 10 requires further evidence where doubts exist. Warning signs include a reply received indirectly or one that seems not to come from the intended party (A11). Emailed or faxed replies are harder to authenticate; a secure, controlled process improves reliability (A12), and a phone call to the sender can verify an email (A14). An oral reply is not an external confirmation, though the auditor can ask for written confirmation (A15). Restrictive wording in a reply does not by itself invalidate it (A16). An unreliable response should prompt a re-look at risk, including fraud (para 11).
Exceptions must be investigated (para 14). Many turn out to be timing or clerical differences rather than misstatements (A22), but they can also indicate misstatement or a control deficiency (A21).
What goes in the audit file?
Keep the trail short and reperformable:
- Basis for selecting the items and for choosing positive, negative or blank form, with the reason.
- Population reconciled to the ledger, the list of parties, and proof of address checks.
- Dispatch log with dates, follow-ups, and how replies were received.
- Each reply, or an alternative-procedure workpaper for each non-response.
- Exception analysis and reconciliation, with the conclusion for each.
- For refusals: management's reason, the evidence tested, and the communication with those charged with governance.
- A concluding memo on whether the procedure gave sufficient appropriate evidence (para 16).
Firms running this across many clients can track dispatch and replies inside CORAA's client portal, which supports SA 505 confirmations tracked to reply. The judgment on selection, reliability and conclusion stays with the auditor.
Last reviewed: 26 September 2026. Sources: ICAI, SA 505 External Confirmations; SA 500, SA 330, SA 240, SA 260 (Revised) and SA 705 (Revised) as referenced in that text.
Frequently asked questions
Who sends the balance confirmation, the auditor or the client?
The request goes on the entity's letterhead, but the auditor maintains control under paragraph 7: selecting parties, checking addresses and sending the requests, with replies returned directly to the auditor.
Can I rely on negative confirmations alone for debtors?
Only if all four paragraph 15 conditions are met: low assessed risk with control evidence, many small homogeneous balances, a very low expected exception rate, and no reason for recipients to ignore the request. For significant balances, use positive requests.
Is a non-reply from a debtor treated as agreement?
No. Each non-response to a positive request requires alternative audit procedures under paragraph 12, such as testing subsequent receipts and shipping documents.
What if the client asks us not to confirm a particular customer?
Ask for the reasons, test whether they are valid and reasonable, assess the fraud and misstatement risk implications, and perform alternative procedures (para 8). If the refusal is unreasonable, tell those charged with governance and consider the opinion.
Is an emailed confirmation acceptable?
It can be, but reliability carries more risk because origin and alterations are harder to verify. Use a secure process or verify with the sender, for example by telephone (A12, A14).
Does a bank confirmation cover only account balances?
It should not. Ask for accounts, deposits with lien status, loan facilities and security, guarantees and letters of credit, and safe-custody items.
Does a confirmation reply prove the balance is recoverable?
No. It addresses existence and the accuracy of the balance, not valuation or recoverability. Ageing and subsequent-receipt testing address collectability separately.
Ready to run confirmations without a separate mail thread? Start a trial.