How to Use ChatGPT and Claude for Balance Confirmation Letters: A Step-by-Step Guide for Auditors
A general AI assistant such as ChatGPT, Claude or Gemini can draft confirmation letters, build a reply tracker and outline non-response follow-up in minutes, provided you supply the rules and check the output. It is a drafting aid only: under SA 505 the auditor must control what is confirmed, who is asked, how requests are sent and where replies go.
This guide is the hands-on companion to Balance Confirmation Letter Format Under SA 505, which sets out the standard. Read that first; the prompts below reuse its rules.
What can ChatGPT or Claude do here, and what should you never delegate?
| Good use of AI (you review every line) | Never delegate |
|---|---|
| Drafting positive, negative and blank-form letter text | Choosing which balances and parties to confirm |
| Turning a party list into a dispatch and reply tracker layout | Validating addresses and sending the requests |
| Drafting polite follow-up wording | Receiving replies (they must come directly to you) |
| Listing alternative procedures by account type for you to select from | Judging whether a reply is reliable or a non-response is a risk signal |
| Structuring the working-paper memo | The conclusion on sufficiency of evidence |
An AI tool has no way to check that an address is real, that a reply came from the intended person, or that a balance ties to the ledger. Those are the auditor's controls under SA 505 para 7, and no prompt changes that.
Step 1: Set up a safe workspace
Use placeholders, not real data. Never paste client names, PAN, GSTIN, CIN, bank account numbers or identifiable balances into a consumer AI tool. Replace them with tokens such as [Entity], [Debtor A] and rounded synthetic figures, then substitute the real values in your own Word or Excel file. Use a paid or enterprise setting where training on your inputs is switched off, and keep a note of which tool and settings you used. The DPDP-safe prompt template library covers anonymisation patterns in detail.
Step 2: Draft the letter from the standard, not from memory
Give the assistant the rules so it applies them instead of inventing them.
You are helping a statutory auditor in India draft an external confirmation
request under SA 505. I am the auditor and I control the process.
Rules to apply:
- The request is on the entity's letterhead but the reply must go DIRECTLY
to the auditor at the address I give, not to the entity.
- Type: positive [or blank form / negative - choose one: ____].
- Confirming party type: [trade debtor / trade payable / bank].
- Include a reply slip with Agreed / Not agreed and space for details.
- Ask the party to explain any difference (e.g. payments in transit).
Use only placeholders: [Entity], [Party], [Date], [Amount], [Auditor address].
Do not invent addresses, amounts or names. Then list any assumptions you made.
Compare the result with the sample in the companion post or the editable external confirmation request template. For banks, ask a second prompt to add every account, deposits and liens, borrowings with limits and security, guarantees and letters of credit, and items in safe custody, rather than balances alone.
Step 3: Build the tracking sheet
Design an Excel confirmation tracker for SA 505 with columns for: party ref,
party type, ledger balance, confirmation type (positive/negative/blank), address
verified (Y/N, by whom), date sent, method, first follow-up date, reply date,
how reply was received, agreed / difference / no reply, difference reconciled,
alternative procedure reference, and reviewer initials. Give the column
headers as a table and suggest a formula that flags requests sent more than
14 days ago with no reply. Assume no client data; use dummy rows.
Paste the headers into Excel, test the flag formula on dummy rows, and only then load real data offline.
Step 4: Plan non-response follow-up
Ask the assistant for a short reminder text, then for a menu of alternatives you can choose from.
I am auditing trade [receivables / payables]. A party has not replied to a
positive confirmation and a re-verified follow-up. List alternative audit
procedures an auditor could consider under SA 505 for this account type, what
evidence each would produce, and what would make each insufficient. Do not
say the balance is verified. Flag when alternative procedures are NOT
enough because only external confirmation can give the evidence needed.
Expect items like examining subsequent cash receipts matched to invoices, shipping documents and period-end sales for receivables, and subsequent disbursements, third-party correspondence and goods received notes for payables. You decide which apply to the balance in front of you.
Step 5: Document alternative procedures
Draft a working-paper template for one non-response with these headings:
balance and assertion tested, why no reply (undelivered / ignored /
refused), follow-up steps and dates, alternative procedures performed,
evidence references, result, effect on risk assessment, conclusion.
Leave blanks for the auditor to complete. Do not fill in results.
A blank template is the right output. If the assistant fills in results, delete them; evidence you did not obtain cannot go in the file.
What does a good answer look like?
A good response is structured, uses only your placeholders, states its assumptions, and leaves conclusions blank. Specifically, check that the letter:
- directs the reply to the auditor, not the entity;
- names one confirmation type and matches it to the party;
- has a difference-explanation option;
- contains no invented amounts, addresses or reference numbers.
The exact wording varies from run to run, so treat any output as illustrative and re-check it against the standard each time.
Where does AI go wrong on confirmations?
- Routing replies to the client. Drafts sometimes say "please confirm to us". Fix to the auditor's address; a reply routed through the client weakens reliability.
- Treating silence as agreement. Negative requests and non-response are often described loosely. Silence is never evidence; a non-reply to a positive request needs alternative procedures.
- Allowing negative confirmation as sole evidence. It is permitted only if the SA 505 para 15 conditions (low assessed risk, many small homogeneous balances, very low expected exceptions, nothing to make recipients ignore the request) all hold.
- Invented facts. Ask for placeholders and search for any figure or address you did not supply.
- Missing the refusal path. If management refuses confirmation, para 8 requires evaluating the reason and risks; an AI-drafted "alternative procedure only" note may skip that.
Verify in 60 seconds
Open the companion post and check the draft against the sample letter and the non-response table. Then compare the wording with the external confirmation request template. If the AI draft differs on who receives the reply, the confirmation type or the reply slip, fix it. Firms that run confirmations at scale can track dispatch and replies in CORAA's client portal, which keeps the auditor in control of the trail.
Which assistant should you use?
ChatGPT, Claude and Gemini can all handle these prompts. What matters more is the setting: paste the standard's rules into the prompt, ask for assumptions, and turn off training on your data where the tool allows it. Tools that let you attach a document can read the SA 505 text you supply, but still verify quotes against the ICAI source.
Last reviewed: 26 September 2026.
Want the tracking and follow-up handled in one place? Start a CORAA trial.
Frequently asked questions
Can I let ChatGPT or Claude send the confirmation requests?
No. SA 505 requires the auditor to maintain control over sending requests and receiving replies. AI can draft text; dispatch and receipt stay with you.
Is it safe to paste a debtor list into ChatGPT?
Not with real names, PAN, GSTIN or balances. Use placeholders and synthetic figures, and load real data into your own spreadsheet offline.
Can AI decide whether to use positive or negative confirmations?
It can explain the difference, but the choice depends on your risk assessment and the para 15 conditions. That is your professional judgment.
What if the AI's alternative procedures look sensible but I did not perform them?
They are only suggestions. The file must record procedures you actually performed and the evidence you obtained.
Does a reply drafted or emailed through the client count as external confirmation?
No. A reply that does not come directly to the auditor raises reliability concerns and calls for further evidence.
Should I record that I used AI?
Yes, note the tool, purpose and your review in the working paper as good practice under your firm's quality policies.