Audit Confirmations Under AU-C 505: Bank and Accounts Receivable Confirmation Letters

An external confirmation is audit evidence obtained as a direct written response to the auditor from a third party, such as a bank or a customer. Because the evidence comes from a source outside the entity and goes straight to the auditor, it is generally treated as more reliable than evidence the client produces. That reliability depends entirely on how the process is run.

This guide covers AU-C 505, External Confirmations, the related requirement in AU-C 330 on accounts receivable, and the practical mechanics of bank and receivable confirmations: positive versus negative requests, keeping control of the process, electronic confirmation platforms, non-responses, exceptions and alternative procedures. It paraphrases the standards and is not a substitute for them.

SAS No. 150 is coming. The ASB issued SAS No. 150, External Confirmations, in July 2026. It amends AU-C 505 and AU-C 330 and is effective for audits of periods ending on or after December 15, 2028, with early adoption permitted. Among other changes, it generally requires confirmation of cash and cash equivalents held by third parties unless certain conditions exist, recognizes direct access to a knowledgeable external source's records as a way to confirm, updates the guidance on intermediaries, and sets new conditions for using negative confirmations. This guide describes AU-C 505 as it stands before SAS No. 150.

What is an audit confirmation?

An audit confirmation is a request the auditor sends to a third party asking them to confirm information directly to the auditor. Common uses:

• Cash balances and loans with banks
• Accounts receivable balances or individual invoices with customers
• Accounts payable with vendors, particularly when testing for completeness
• Terms of agreements, such as consignment, side agreements or bill-and-hold arrangements
• Inventory held by third parties, such as public warehouses
• Debt with lenders, including covenant terms and collateral
• Legal matters, through inquiry of the client's lawyers (covered by AU-C 501, not AU-C 505)

When are confirmations required?

AU-C 505 itself sets out how to perform confirmation procedures. The decision to use them comes from other standards.

Accounts receivable. AU-C 330 establishes a presumption that the auditor will request confirmation of accounts receivable. The auditor may overcome it when receivables are immaterial, when confirmation would be ineffective, or when the assessed risk of material misstatement is low and other planned substantive procedures address that risk. If the auditor does not confirm receivables, the reason must be documented.

Other balances. AU-C 330 also asks the auditor to consider whether external confirmation procedures should be performed as substantive procedures. Before SAS No. 150, confirming cash is common practice because it is efficient and the evidence is strong, but the decision is a matter of judgment documented in the audit plan. Once SAS No. 150 applies, cash held by third parties is generally confirmed unless the standard's conditions for not doing so exist.

Positive vs negative confirmations

Positive requests can be blank (the recipient fills in the balance) or show the amount and ask for agreement. Blank forms give stronger evidence because the recipient cannot simply sign, but response rates are often lower.

Conditions for relying on negative confirmations alone

Under AU-C 505, negative confirmations give less persuasive evidence. Before the SAS No. 150 amendments, the auditor should not use them as the sole substantive procedure for a risk at the assertion level unless all of these conditions are present:

1. The risk of material misstatement has been assessed as low, and the auditor has obtained sufficient appropriate evidence about the operating effectiveness of controls relevant to the assertion.
2. The population consists of a large number of small, homogeneous account balances, transactions or conditions.
3. A very low exception rate is expected.
4. The auditor is not aware of circumstances or conditions that would cause recipients to disregard the requests.

In most small and mid-size nonissuer audits, these conditions are not all met, so negative confirmations are usually a supplement to other procedures, not a substitute.

Maintaining control over the process

The value of a confirmation rests on the auditor controlling it from start to finish. AU-C 505 requires the auditor to maintain control over confirmation requests, including determining the information to be confirmed, selecting the confirming party, designing the request and sending it, including follow-up requests.

In practice:

• Select the items yourself. The client can provide the aging and addresses, but the auditor chooses which balances to confirm.
• Verify addresses. Compare addresses to independent sources such as the customer's website, prior-year confirmations or contracts. A confirmation sent to a P.O. box or an address that matches the client's own is a red flag.
• Send it yourself. The request goes out from the auditor, by mail from the auditor's office or through an electronic platform the auditor controls. The client signs the authorization; it does not mail the request.
• Responses come back to the auditor. The return address or email is the auditor's.
• Log everything. A confirmation control log records each request sent, the date, second requests, responses, exceptions and how each was resolved.

Management requests not to confirm

If management refuses to let the auditor send a confirmation, AU-C 505 requires the auditor to ask about the reasons and seek evidence of their validity, consider the effect on the risk assessment including fraud risk, and perform alternative procedures. If the refusal is unreasonable or the auditor cannot get relevant and reliable evidence another way, the auditor communicates with those charged with governance and considers the effect on the audit and the opinion under AU-C 705.

Reliability of responses

The auditor must evaluate whether there are indications that a response is not reliable. Warning signs include:

• A response received from the client rather than directly
• A response from an address or email domain that does not match the confirming party
• A reply that looks altered, or a photocopy or scan with no clear origin
• A response that comes back unusually fast or in unusual form

AU-C 505 notes that a response containing restrictive language (for example, a broad disclaimer) does not necessarily invalidate it, but the auditor considers whether the restriction affects the reliability of the response as evidence.

If doubts remain, the auditor can contact the confirming party directly, using contact details from an independent source, to verify that they sent the response.

Electronic confirmations

Banks may respond only through electronic confirmation platforms. AU-C 505 allows electronic responses; the question is whether the process is reliable.

When using a third-party platform, the auditor considers whether the platform's process reduces the risk of interception and alteration. Common steps include understanding how the platform authenticates both the auditor and the responding bank, and reviewing any available service auditor's report on the platform's controls. Document what the firm relied on.

Email confirmations sent directly to a customer are also acceptable if the auditor verifies the recipient's email address and domain independently and the response comes straight back to the auditor.

Bank confirmation letters

A bank confirmation letter asks the bank to confirm balances and other information as of the balance sheet date. It typically covers:

• Each deposit account, with account number and balance
• Loans and lines of credit, with balances, interest rates, due dates and collateral
• Other liabilities and contingent liabilities, such as guarantees or letters of credit, when requested separately

Standard bank confirmation forms focus on deposit and loan balances and state that the bank is not required to search its records beyond what the request covers. Because of that, a clean bank confirmation is not complete evidence that every liability to the bank is recorded. Separate requests for loan agreements, letters of credit or guarantees, and inspection of the minutes and debt agreements, help address completeness.

Practical points:

• Send requests for every account, including accounts with zero balances and accounts closed during the year.
• Agree confirmed balances to the bank reconciliation, and the reconciled book balance to the trial balance.
• Agree loan details to the debt schedule and the loan agreement.

The bank confirmation letter template provides a standard request for deposits and loans.

Accounts receivable confirmations

AR confirmations primarily address the existence assertion and, to some extent, rights. They do not provide good evidence of valuation, because a customer can confirm it owes a balance and still be unable to pay. Collectibility is tested separately through subsequent receipts, aging analysis and the allowance calculation.

Designing the request

• Balance or invoice confirmations. Some customers, particularly larger companies on voucher payables systems, cannot confirm a total balance but can confirm individual invoices. Offering an invoice-level request improves response rates.
• Selection. Confirm all large balances above a threshold set from performance materiality, then select a sample of the remainder using an approach that fits the sampling plan. See AU-C 530 and the monetary unit sampling calculator.
• Unusual items. Consider confirming balances with credit balances, old balances, related parties and large year-end sales, which are higher risk.
• Terms. Where revenue risk involves side agreements, ask customers to confirm key terms such as rights of return, consignment or acceptance clauses, not just the balance.

The accounts receivable confirmation letter template includes positive balance and invoice-level versions.

Non-responses and alternative procedures

For each positive confirmation that receives no response, AU-C 505 requires alternative audit procedures to obtain relevant and reliable evidence. Second requests come first; if those fail, alternative procedures for receivables typically include:

• Subsequent cash receipts: examining cash received after year end and matching it to the specific invoices that made up the year-end balance. Agreeing to the bank statement is better than agreeing only to the cash receipts journal.
• Shipping and sales documents: examining evidence of shipment or delivery, such as signed bills of lading, along with the customer order and invoice.
• Customer correspondence that supports the balance.

For bank accounts, an alternative might be obtaining the year-end bank statement directly from the bank or reviewing online access with the client present, but for material cash balances a response is usually expected.

If the auditor has determined that a response to a positive confirmation is necessary to obtain sufficient appropriate evidence, alternative procedures will not provide what the auditor needs. Failure to get that confirmation is then a scope issue to evaluate for its effect on the opinion.

Exceptions

An exception is any response that differs from the client's records. The auditor investigates every exception to determine whether it indicates a misstatement. Many exceptions are timing differences, such as payments in transit or goods shipped near year end. Others reveal real errors, unrecorded credits, disputes or possible fraud.

Document each exception, the investigation, the conclusion and, where it is a misstatement, the amount carried to the summary of misstatements under AU-C 450. Projected misstatements from sampled items count too.

Documenting confirmations

Under AU-C 230, the file should show:

• why confirmations were or were not used for each significant account
• how items were selected and addresses verified
• the confirmation control log with dates, second requests and responses
• each response and its evaluation for reliability
• exceptions and their resolution
• alternative procedures for non-responses, with the documents examined
• the conclusion for the account and assertion

Frequently asked questions

Is confirming accounts receivable required in every audit?

Not in every audit. AU-C 330 presumes the auditor will confirm receivables but allows exceptions when receivables are immaterial, confirmation would be ineffective, or risk is low and other procedures address it. The reason for not confirming must be documented.

Can the client mail the confirmation requests?

No. The auditor must maintain control over the requests, including sending them and receiving responses directly. The client can sign the authorization and supply contact information, which the auditor verifies.

What is the difference between a positive and a negative confirmation?

A positive confirmation asks the recipient to respond in every case. A negative confirmation asks for a response only if the recipient disagrees, so it gives much weaker evidence and is limited to specific low-risk conditions.

What alternative procedures can replace an unanswered AR confirmation?

The most common is matching cash received after year end to the specific invoices in the year-end balance. Examining shipping documents, customer orders and correspondence is another option.

Are electronic bank confirmations acceptable?

Yes. AU-C 505 allows electronic responses. The auditor evaluates whether the platform or process reduces the risk of interception and alteration, often using a service auditor's report on the platform.

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

Sources

• AICPA, AU-C Section 505, External Confirmations
• AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained (confirmation of accounts receivable)
• AICPA, SAS No. 150, External Confirmations (amends AU-C 505 and AU-C 330; periods ending on or after December 15, 2028; early adoption permitted): https://www.journalofaccountancy.com/news/2026/jul/aicpa-updates-audit-standards-related-to-external-confirmations
• AICPA, AU-C Section 501 (litigation, claims and assessments), AU-C 705, AU-C 450, AU-C 230, AU-C 530
• Standard Form to Confirm Account Balance Information with Financial Institutions (AICPA, American Bankers Association and Bank Administration Institute)

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error