Definition
The auditor sends the request, controls it, and receives the reply directly, with management not in the middle. A positive confirmation asks the recipient to respond either way, by agreeing with a stated amount or filling in the amount. A negative confirmation asks for a reply only if the recipient disagrees.
Why it matters in an audit or review
Evidence from an independent outside party is among the most reliable, which is why confirmations are standard for bank balances, receivables and debt. AU-C 505 generally allows negative requests alone only when risk is low, controls over the area were tested and found effective, there are many small homogeneous balances, the expected exception rate is low, and there is no reason to think recipients will ignore them. Silence on a negative request proves little.
Example
Receivables have 400 customers and a $5.2 million balance (illustrative). The auditor sends positive confirmations to the 25 largest, covering 60 percent of the balance, and negatives to a random group of small accounts. Nonresponses on the positives lead to alternative procedures.
Common mistakes
- Letting the client mail the requests or collect replies.
- Using recipient-provided email addresses without verifying them.
- Treating a negative confirmation with no reply as evidence of accuracy.
FAQ
What if management asks the auditor not to confirm?
The auditor asks why and evaluates the reasons and the fraud implications. If the request is reasonable, the auditor performs alternative procedures. If not, and the auditor cannot confirm, the effect on the opinion has to be considered.
Sources
- AICPA, AU-C Section 505, External Confirmations (definitions, positive and negative requests, management's refusal to allow confirmation)
- AICPA, AU-C Section 500, Audit Evidence
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error