PCAOB Release No. 2023-008 retitled AS 2310 "The Auditor's Use of Confirmation" and rewrote it in full for audits of financial statements for fiscal years ending on or after June 15, 2025. The old text, "The Confirmation Process," presumed confirmation of receivables unless they were immaterial, confirmation would be ineffective, or risk was low. The new text requires, for cash and accounts receivable, either confirmation or direct access to information maintained by a knowledgeable external source (paragraph .24).
This article walks through AS 2310 and then lists the differences from AU-C 505. For the AICPA standard in depth, see audit confirmations under AU-C 505.
When does AS 2310 call for confirmation?
The objective is relevant and reliable audit evidence from a knowledgeable external source about relevant assertions of a significant account or disclosure (.02).
- Cash and accounts receivable (.24). The auditor performs confirmation procedures under paragraphs .08 to .23, or otherwise obtains evidence by directly accessing information maintained by a knowledgeable external source.
- Receivables where that is not feasible (.25). Based on experience, such as prior audits where no confirmation responses came back, and an expectation of similar results, the auditor obtains external information indirectly through other substantive procedures, including tests of details, and documents the determination under AS 1215.
- Audit committee (.28). For significant risks associated with cash or receivables, the auditor communicates when it did not confirm or directly access external information.
- Other relationships (.29). For cash, the auditor considers confirming other financial relationships with the same source, such as credit lines, debt and guarantees. See the bank confirmation process.
- Complex or significant unusual transactions (.30). For significant risks tied to such transactions, the auditor considers confirming the terms associated with the risk, such as oral or undisclosed side agreements, bill and hold sales, and supplier discounts or concessions.
Designing the request
- Information to confirm (.08). A positive request asks the party to agree or disagree with stated information. A blank form states no amount and asks the party to fill it in. The note says a blank form may provide more reliable evidence but may lower response rates.
- Confirming parties (.09 and .10). Requests go to parties knowledgeable about the information and are properly addressed. Information about a party's motivation, ability or willingness to respond, or its objectivity and freedom from bias, is considered in selecting the party.
- No suitable party (.11). The auditor performs alternative procedures for the item under Appendix C.
Negative requests
A negative request asks for a response only if the party disagrees (Appendix A). Paragraph .12 says negatives provide significantly less evidence and that negatives alone do not provide sufficient appropriate evidence for a risk of material misstatement. Paragraph .13 gives examples where negatives combined with other substantive procedures may suffice: risk assessed as low with sufficient evidence on controls, a population of many small homogeneous items, and a low expected exception rate with a reasonable basis. See negative confirmations: conditions and limits.
Control, responses and exceptions
The auditor selects the items, sends the requests and receives the responses (.15), sending directly to the confirming party and obtaining the response directly from it (.16). An intermediary may facilitate electronic transmission, and the auditor evaluates the implications under Appendix B (.17). Appendix B requires understanding the intermediary's controls over interception and alteration, testing their design and operation, and assessing whether the company can override them. If they fail, the auditor does not use the intermediary (.B2).
Paragraph .18 requires evaluating response reliability. The note gives signs of interception or alteration: a response from a different address than on the request, no signature or identification of the party, and no copy of the original request. An unreliable response leads to alternative procedures (.19). Paragraph .20 requires evaluating exceptions, individually and in aggregate, as a misstatement under AS 2810, a deficiency in internal control over financial reporting, or both.
What happens when there is no response?
- Follow up with the party when no response to a positive request arrives (.21).
- If a response goes to anyone other than the auditor, ask the party to re-send it directly. If it does not arrive, treat it as a nonresponse (.22).
- Perform alternative procedures for a nonresponse or incomplete response (.23).
Appendix A defines a nonresponse as a request returned undelivered, no direct response to a positive request, a statement that the party cannot or will not respond, or an oral response only. Appendix C lists alternatives. For receivables: subsequent cash receipts compared with the invoices paid, shipping documents, or purchase orders and signed contracts. For payables: subsequent disbursements or vendor correspondence.
The Appendix C note adds that alternative procedures for items the auditor could not complete may not be necessary if those items, in aggregate and added to all other uncorrected misstatements in relation to the account, would not change the outcome of the AS 2810.17 evaluation. The auditor treats the items as 100 percent misstatements and, when sampling is used, projects them under AS 2315.26. Paragraph .31 then requires weighing all evidence from confirmations, alternative procedures and other procedures. See alternative procedures for unanswered receivable confirmations.
Worked example
An issuer's auditor confirms all 18 receivable accounts above a set balance, which are $2,640,000 of a $3,850,000 ledger. Fourteen accounts reply, with uncorrected misstatements totaling $22,500. Four do not reply; their balances total $186,400. Materiality for the evaluation is $300,000.
| Item | Amount |
|---|---|
| Nonresponse balances, treated as 100 percent misstatements | $186,400 |
| Other uncorrected misstatements | $22,500 |
| Combined | $208,900 |
| Materiality for the evaluation | $300,000 |
The combined figure of $208,900 is below $300,000, so the Appendix C note permits omitting alternative procedures if the AS 2810.17 evaluation is unchanged. Suppose instead the nonresponse balances were $412,000. The combined figure of $434,500 exceeds $300,000, so alternative procedures are required for those items.
How does AS 2310 differ from AU-C 505?
| Topic | AS 2310 | AU-C 505 |
|---|---|---|
| Receivables | Confirm or directly access external information for cash and receivables (.24); indirect evidence only where infeasible, documented (.25) | Required to use confirmation for receivables unless balance is immaterial, ineffective, or assessed risk is low and other planned procedures address it (.03, citing AU-C 330) |
| Negatives | Alone insufficient (.12); examples with other procedures (.13) | Not the sole substantive procedure unless four conditions are all present (.15) |
| Nonresponses | Follow up, re-send rule, alternative procedures (.21 to .23); aggregate note in Appendix C | Alternative procedures for each nonresponse (.12); A26 describes when more are unnecessary |
| Oral responses | An oral response only is a nonresponse (Appendix A) | Not an external confirmation; may inform alternative procedures (A27) |
| Management refusal | No equivalent paragraph | Inquire, evaluate fraud risk, perform alternatives, communicate with those charged with governance if unreasonable (.08 and .09) |
| Written response necessary | No equivalent paragraph | Alternative procedures will not provide the evidence; determine implications for the opinion (.13) |
AU-C 505 is amended by SAS 150 for audits of periods ending on or after December 15, 2028; see SAS 150: what changes and when.
Frequently asked questions
Is confirming receivables required in every issuer audit?
Paragraph .24 requires confirmation or direct access to external information for receivables. Paragraph .25 allows indirect evidence only where experience shows that approach is not feasible, with documentation under AS 1215.
Does AS 2310 set the number of items to confirm?
No paragraph sets a number. Paragraph .04 points to AS 2301 for responses to assessed risks, and a footnote points to AS 2315 for audit sampling. See AS 2315 versus AU-C 530.
Sources
- PCAOB, AS 2310, The Auditor's Use of Confirmation, paragraphs .01 to .31 and Appendices A to C: https://pcaobus.org/oversight/standards/auditing-standards/details/AS2310
- PCAOB, Release No. 2023-008, adopting release with the text of the new standard and its effective date: https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/docket_028/2023-008_confirmation-adopting-release.pdf
- AICPA, AU-C Section 505, External Confirmations, paragraphs .03, .06, .08, .09, .12, .13, .15 and application material A1, A26 and A27: https://www.aicpa-cima.com/resources/landing/aicpa-professional-standards
CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error