A bank confirmation is the audit's best evidence that cash exists. It comes from outside the client, directly to the auditor, and it is in writing. Firms often send a request for the main operating account and miss closed accounts, credit lines, guarantees and swaps. This guide sets out the process and the limits of what the reply proves. For the general rules on external confirmations, see audit confirmations.
Step 1: Decide whether to confirm
Bank confirmation is the usual evidence for the existence of cash and debt, and a skipped confirmation needs a documented basis. The auditor considers whether to perform external confirmation procedures as substantive procedures under AU-C 330 and AU-C 500. The written exceptions that the standards state expressly apply to receivables: an immaterial balance, ineffective confirmation, or low assessed risk with other planned procedures that address it.
Step 2: Build the list of institutions and accounts
Do not rely on the client's list of accounts. Compile from:
- The general ledger cash and debt accounts.
- Prior-year confirmations and the prior-year file.
- Bank statements received for any period.
- Loan agreements, lease agreements and credit facility documents.
- Insurance, investment and brokerage statements.
- Interest income and bank fee expense accounts, which show institutions the ledger cash lines miss.
- Accounts closed during the year, which still need confirming because a balance can move out at year end.
Ask management in writing for a complete list of every institution where the entity has or had an account, loan, line of credit, guarantee or safe custody item. Compare the list to what the audit found.
Step 3: Decide what to ask the bank to confirm
A bank confirmation request can reach more than the balance, but not all of it on one form. The areas to cover are:
- Account balances at the confirmation date for each type: operating, savings, money market, foreign currency, overdraft.
- Loans and lines of credit: balance, interest rate, maturity, unused capacity and collateral.
- Guarantees, indemnities and letters of credit the bank has issued for, or holds from, the entity.
- Items held as security for the entity's liabilities.
- Accounts opened or closed during the period.
- Derivative and treasury contracts such as swaps, forwards and options.
The standard form for financial institutions, approved jointly by the American Bankers Association, the AICPA and the Bank Administration Institute, covers deposit and loan account balances. Guarantees, letters of credit, collateral, derivatives and safe custody items are outside that form, so send a separate, authorized inquiry for them when the bank holds a relationship beyond deposits.
Step 4: Keep control of the request
The auditor controls the process from end to end. The request includes the right bank branch or department, is addressed and returns directly to the auditor, and uses a return address that is not the client's. The control steps are:
- The client signs the authorization, on client letterhead if the bank needs it.
- The auditor, not the client, sends the request, by mail or by an electronic process the firm has evaluated. A client that hand-carries or emails requests breaks control.
- The reply goes straight to the auditor. A reply forwarded by the client has lost independence.
- The auditor logs the request, follows up if a response is late and records the date of receipt.
When the process is electronic, the auditor still relies on the system working as designed. The firm decides, before relying, whether the tool authenticates the sender and protects the reply from alteration. If the firm uses a platform it has not evaluated, the reply is weaker evidence.
Step 5: Evaluate the reply
For each reply, check:
- The sender is the intended bank, and the signer and branch are plausible.
- The date is the balance sheet date or close to it.
- The balances agree to the book cash accounts and the bank reconciliation.
- The reply covers every account on the request. A missing account is an unanswered question.
- The reply states no restrictions or disclaimers that undercut it.
- Collateral, guarantees and liens agree to what the loan documents say.
If you doubt a reply, obtain further evidence. Call the bank on a number you looked up independently, not one printed on the reply. If the reply is unreliable, assess the effect on the fraud risk and the remaining procedures.
Step 6: Follow up non-replies and exceptions
For every non-reply, send a second request, call the bank and then perform alternative procedures: inspect the bank statement obtained directly from the bank, test the subsequent clearing of reconciling items and vouch to loan agreements. A response is required where the audit cannot rely on alternatives, and failure to obtain it requires considering the effect on the opinion.
Investigate each exception to see whether it is a misstatement. A bank balance different from the book balance is a reconciling item until shown otherwise, and the bank reconciliation explains it. A loan the books do not show is a different matter.
What a bank confirmation does not prove
The reply supports existence of the balance. It does not prove completeness of accounts and arrangements. Consider these cases:
- Limited language. If the bank states that it did not search all its records, or confines its answer to the accounts listed, the reply does not support completeness.
- Unanswered questions. An unanswered question on contingent liabilities is an open question, not a clean answer.
- Accounts in other institutions. The bank confirms only its own relationship.
To support completeness, combine the reply with other evidence: the list management signed, interest income analysis, bank fee analysis, review of the mail log for statements, and in a higher-risk audit, a request to the relationship manager to confirm no other accounts or arrangements exist.
Worked example
A client reports $2.77 million of cash across three accounts at two banks and a $3 million credit line. The auditor confirms with both banks. The replies show:
- Operating account $1,962,400 (books $1,962,400).
- Payroll account $214,000 (books $207,900). Reconciliation shows outstanding checks of $6,100.
- Savings $602,000 (books $602,000).
- A further account at the second bank, opened in March, with $48,300. Books show nothing.
- Credit line drawn $1,275,000. Books show $1,200,000.
The senior investigates. The unrecorded account is a customer deposit account that the controller opened for a project, and the controller netted it within "other receivables". It needs to be shown gross: cash and a customer deposit liability. The credit line difference is a $75,000 draw on December 29 that was recorded on January 3. Both are misstatements, one a classification entry, one a cutoff entry. They go on the adjusting entry log. The file also notes that the unrecorded account suggests weakness in management's list of accounts, which changes the extent of completeness work.
Documentation checklist
- List of institutions and accounts with the source for each.
- The signed requests and the log of date sent and received.
- Replies in the file and the tie to books and reconciliations.
- Follow-up and alternative procedures for non-replies.
- Exceptions resolved or carried to the adjusting entries.
- Completeness conclusion.
CORAA prepares ready-to-review audit files for US CPA firms; the firm keeps the client, the review and the signature. See /us.
Sources
- AICPA, AU-C Section 505, External Confirmations; AU-C Section 500, Audit Evidence; AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained
- U.S. Government Accountability Office, Financial Audit Manual, Volume 1 (GAO-26-108577), June 2026, FAM 470 (external confirmations; the conditions for not confirming accounts receivable): gao.gov
- American Bankers Association, AICPA and Bank Administration Institute, Standard Form to Confirm Account Balance Information with Financial Institutions: aicpa-cima.com
- Australian Auditing and Assurance Standards Board, guidance on the bank confirmation process (sole reliance on a bank confirmation for completeness is generally unwarranted): standards.auasb.gov.au
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error