A negative confirmation asks the recipient to reply only if the information is wrong. A positive confirmation asks for a reply either way. Negative requests are cheap to send and cheap to evaluate, which is why they are tempting, and why the standard fences them in. This post sets out the fence, the reasoning and the working rules. For the general confirmation process see audit confirmations.
The rule
Negative confirmations provide less persuasive evidence than positive confirmations. So the auditor does not use negative requests as the sole substantive procedure for an assessed risk of material misstatement at the assertion level unless all four of these conditions hold:
- Low risk, supported by control evidence. The auditor has assessed the risk of material misstatement as low and has obtained sufficient appropriate evidence that relevant controls operate effectively.
- Many small, similar items. The population is a large number of small, homogeneous account balances, transactions or conditions.
- Very low expected exception rate. The auditor expects almost no errors.
- No reason to expect disregard. The auditor is not aware of circumstances that would lead recipients to ignore the request.
If any condition fails, use positive confirmations, or add other substantive procedures such that the combination is sufficient. Negative requests can still serve as a supplement.
Why the evidence is weak
Silence proves little. A recipient who does not reply may have received and checked the request, may have received and ignored it, or may never have received it. The request provides no assurance of delivery. A customer that does not exist never replies, so silence is exactly what a fictitious balance produces. The evidence that comes back is also lopsided: a recipient is more likely to dispute a balance that is too high against them than one that is too low in their favor. That helps a little with overstated receivables and not at all with understated payables. It does not cure the main weakness, which is that agreement and non-receipt look the same. That is why negative requests rarely suit the receivables existence assertion by themselves.
Condition-by-condition application
Condition 1: low risk and control evidence. Testing controls over billing, cash application and credit memos has to be in the file, with results that support a low risk assessment. If the client's controls are weak or untested, the condition fails. A utility with thousands of residential customers and strong billing controls can meet it. A distributor with a handful of large customers and manual invoicing cannot.
Condition 2: many small homogeneous items. Residential customers, small-dollar subscribers and retail customers qualify. A population that includes a few large balances or heterogeneous items does not. Stratify: positive confirmations on the large items, negative on the small residual.
Condition 3: very low exception rate. Use the prior-year exception rate and the control test results. If the prior year's confirmations turned up exceptions at a rate of several percent, the condition is not met.
Condition 4: no reason to disregard. Unclear invoices, recipients with no ability to verify, bulk mailings that look like marketing, or a population that includes customers in dispute all fail this condition. So does a population where recipients are unsophisticated and cannot evaluate their balance.
Worked example
A regional water cooperative has 18,000 residential accounts averaging $140 and 40 commercial accounts averaging $12,000. Receivables total $3.0 million, of which residential is $2.52 million.
- Billing controls were tested with no deviations in a 45-item attribute sample (see attribute sampling), and the risk of material misstatement for the residential population is low.
- Residential accounts are small and alike. Expected exception rate is below 1 percent per the prior year's file.
- There is no reason to think recipients will disregard the request.
All four conditions hold for the residential stratum. The auditor sends 150 negative confirmation requests, randomly selected, with return envelopes addressed to the firm. At about $140 each they cover roughly $21,000, under 1 percent of the residential stratum, so the auditor also runs analytical procedures and cash receipts testing on the stratum; the negative requests are one part of the evidence. The 40 commercial accounts fall outside the conditions: they are large, heterogeneous and not within a low-risk assessment. The auditor sends positive confirmations on all 40, which cover $480,000.
Results: 6 negative replies disputing the balance, 4 of which are timing of payments received after the statement date and 2 are real billing errors of $85 and $140. Undelivered requests: 9, which the auditor treats as non-responses and tests with alternative procedures. The auditor evaluates the exceptions the same way as positive exceptions. See confirmation exceptions.
Working rules
- Document each condition. A workpaper that says "negatives used" without addressing each condition is incomplete.
- Mail from the firm, with the return address of the auditor, so responses come directly. Undelivered mail returns to the firm, and each return is a lead.
- Treat returned mail as a signal. A cluster of undelivered requests may mean nonexistent customers.
- Do not count non-replies as confirmation. Silence cannot be tallied as agreement in the file.
- Follow up on every reply. Each reply is an exception to investigate.
- Consider response rate. A rate well off prior years deserves an explanation. Compare to prior years.
- Combine with other tests. Pair negative requests with analytical procedures, cash receipts testing and cutoff testing.
Where negatives do not belong
- Existence of large receivable balances.
- Populations with an elevated fraud risk, including revenue recognition risks.
- Accounts where recipients cannot readily verify the balance, such as complex multi-element billing.
- Any situation where the auditor needs a response to obtain sufficient evidence. In that situation, a positive request is necessary, and alternative procedures will not substitute.
Documentation
The file shows the conditions and why each is met, the population and selection, the request and return address, the replies, the undelivered requests, the follow-up and the conclusion. Cross-reference to the controls testing and the risk assessment that supports condition 1.
CORAA prepares ready-to-review audit files for US CPA firms; the firm keeps the client, the review and the signature. See /us.
Sources
- AICPA, AU-C Section 505, External Confirmations
- AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained; AU-C Section 240, Consideration of Fraud in a Financial Statement Audit
- U.S. Government Accountability Office, Financial Audit Manual, Volume 1 (GAO-26-108577), June 2026: gao.gov (FAM 470 on external confirmation of accounts receivable; the manual does not set negative-confirmation conditions)
- Australian Auditing and Assurance Standards Board, ASA 505 External Confirmations (the ISA-based text, same four conditions for negative requests): standards.auasb.gov.au
- Study guide on AU-C 505 (positive, negative and blank forms; negative conditions; non-responses): open-exam-prep.com
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error