A confirmation test does not end when the replies arrive. It ends when every reply has a category, every difference has a cause and the totals tie to a conclusion. Many files stop earlier: a few exceptions noted, a general remark that "differences were timing," and a projection nobody did. This post sets out the log, the causes and the conclusion. For the process before the replies see audit confirmations and bank confirmations.
The four outcomes
Each confirmation falls into one of four groups.
- Agreed. The confirming party agrees with the information or provides it without exception.
- Unreliable. There are factors that raise doubts about the reply: it came indirectly, it did not appear to come from the intended party, or it arrived by a channel whose origin cannot be verified.
- Non-response. No reply, or an undelivered request. Alternative procedures are required. See alternative procedures.
- Exception. The reply disagrees with the information.
The standard asks the auditor to investigate exceptions to see whether they indicate misstatements. It adds that exceptions can guide the quality of responses from similar parties, and can point to deficiencies in internal control. Some exceptions are not misstatements: timing, measurement or clerical differences in the confirmation process itself.
The log
One log for the whole confirmation population:
| Column | Content |
|---|---|
| Ref | Confirmation number |
| Party | Name and address |
| Book balance | Per the ledger on the confirmation date |
| Date sent, follow-up dates | Control record |
| Date received and how | Direct to the firm, email, fax, indirect |
| Outcome | Agreed, unreliable, non-response, exception |
| Confirmed amount | Per the reply |
| Difference | Book minus confirmed |
| Cause category | See below |
| Follow-up procedure | What was done |
| Misstatement | Yes, no, amount, type (factual, projected) |
| Resolved by and date | Preparer and reviewer initials |
Each row traces to the scanned reply and the follow-up evidence.
Cause categories for exceptions
Classify each difference. The common categories for receivables:
| Cause | What it means | Misstatement? |
|---|---|---|
| Payment in transit | Customer paid before year end; client recorded receipt after | Usually cutoff error if the cash was received before year end and recorded late; not an error if the cash was received after |
| Invoice or shipment timing | Goods in transit, recorded by seller at shipment but by buyer at receipt | Depends on shipping terms and control transfer |
| Credit memo or return not recorded | Customer returned goods or received an adjustment | Misstatement |
| Pricing or quantity dispute | Customer disputes the invoice | Evaluate allowance or revenue |
| Misapplied payment | Payment applied to the wrong account or invoice | Classification between customers, usually no net effect |
| Customer clerical error | Customer's records are wrong | Not a misstatement; document evidence |
| Disputed or fictitious invoice | Customer denies the order or the amount | Potential fraud; escalate |
For payables the list includes unrecorded invoices, early payments, advance deposits and disputed charges. For banks: reconciling items and unrecorded accounts.
Investigating
For each exception, follow the ladder:
- Ask the client for its explanation and the support. Compare to the customer's reply.
- Obtain independent evidence. Inspect the remittance advice, bank deposit, shipping record, credit memo or contract.
- Contact the confirming party if the reply is unclear. Use contact information the auditor verified, not the client's.
- Conclude on whether the item is a misstatement and its type and amount.
- Consider the pattern. The same cause in several items suggests a systemic issue that needs a broader test.
- Consider fraud. A misstatement identified requires an evaluation of whether it indicates fraud.
Unreliable replies
If a reply came by email from an address you cannot tie to the party, call the party using a number you looked up, and ask whether it sent the reply. If a reply came to the client first and was forwarded, ask the party to reply directly. An oral reply by itself is not a confirmation: request a written reply direct to the auditor, and if none comes, seek other evidence. A reply with restrictive language about its use does not necessarily lose its value as evidence. If you conclude a reply is unreliable, assess the effect on the risk assessment, including the risk of fraud, and on the remaining procedures.
Worked example
A client with trade receivables of $4.8 million sends 60 positive confirmations covering $3.1 million. Results:
| Outcome | Count | Book amount |
|---|---|---|
| Agreed | 49 | 2,482,000 |
| Non-response | 6 | 410,000 |
| Exception | 5 | 208,000 |
| Unreliable | 0 |
The five exceptions:
| Ref | Book | Confirmed | Difference | Cause | Conclusion |
|---|---|---|---|---|---|
| 12 | 48,200 | 36,200 | 12,000 | Customer's check received December 30; client posted it January 2 | Cash receipts cutoff. Misstatement 12,000 (receivables overstated, cash understated) |
| 23 | 31,000 | 31,000 less 4,500 credit | 4,500 | Credit memo for damaged goods issued in January | Misstatement 4,500: credit relates to a year-end sale |
| 31 | 64,000 | 0 | 64,000 | Customer says order cancelled | Inspect order and shipping: delivered December 29 and signed; not a misstatement. Customer error |
| 40 | 22,300 | 22,300 less 800 | 800 | Pricing dispute | Below the clearly trivial threshold; not accumulated, noted on the log |
| 52 | 42,500 | 38,000 | 4,500 | Misapplied payment to another account of the same customer | No net effect across the two accounts; no misstatement |
Misstatements in the sample: $16,500 (12,000 + 4,500). The misstatements came from items selected by sampling, so the auditor projects them to the untested population with a method suited to the selection; any items chosen as key items are not projected. See evaluating sample results. Two of the five exceptions are cutoff-type causes (a receipt posted late and a credit memo issued after year end for a year-end sale), so the auditor extends the sales and cash cutoff tests and tells the manager the pattern points to a lag in posting cash and credits. The adjustments go on the adjusting entry log.
Conclusion paragraph
The workpaper ends with a conclusion that covers: outcomes by category and amounts, the number and nature of exceptions, the misstatements and their projection, the non-responses and the alternative procedures, the effect on the allowance, and whether the evidence is sufficient. Sign it off.
Documentation checklist
- Complete log with every confirmation.
- Scanned replies and follow-up evidence.
- Cause category for every exception.
- Misstatement computation and cross-reference to the adjusting entry log.
- Pattern and fraud evaluation.
- Conclusion.
CORAA prepares ready-to-review audit files for US CPA firms; the firm keeps the client, the review and the signature. See /us.
Sources
- AICPA, AU-C Section 505, External Confirmations
- AICPA, AU-C Section 240, Consideration of Fraud in a Financial Statement Audit; AU-C Section 450, Evaluation of Misstatements Identified During the Audit
- U.S. Government Accountability Office, Financial Audit Manual, Volume 1 (GAO-26-108577), June 2026: gao.gov (FAM 470, external confirmations)
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error