AU-C section 505, External Confirmations, deals with the auditor's use of external confirmation procedures to obtain audit evidence in a GAAS audit of a nonissuer. It came out of SAS No. 122. In July 2026 the AICPA published SAS No. 150, External Confirmations, which amends AU-C 505 and various related sections. SAS 150 applies to audits of periods ending on or after December 15, 2028, and early adoption is permitted. Until then the current AU-C 505 applies.
This page paraphrases the standard. Read AU-C 505 and, when it applies, SAS 150 in AICPA Professional Standards before relying on any point here. The first sections describe the current requirements, then the SAS 150 changes.
What is the objective of AU-C 505?
The auditor's objective, when using external confirmation procedures, is to design and perform those procedures to obtain relevant and reliable audit evidence.
An external confirmation is audit evidence obtained as a direct written response to the auditor from a third party (the confirming party), in paper form or by electronic or other medium. The word "direct" is the key point. Evidence that passed through the client's hands is not an external confirmation.
For the practical guide on bank and receivable confirmations, see the audit confirmations guide. Templates: bank confirmation letter and accounts receivable confirmation letter.
When does the auditor use confirmations?
AU-C 505 explains how to perform confirmations. The decision to use them comes from AU-C 330 and the assessed risks. AU-C 330 presumes the auditor will request confirmation of accounts receivable, unless one of the listed circumstances applies. The auditor also considers confirmations for other balances and terms, such as bank balances and borrowings, accounts payable, inventory held by third parties and terms of agreements.
External confirmation procedures give strong evidence for existence, and for rights and obligations. They are less suited to valuation (for example, whether a receivable is collectible) or to completeness, unless the request is designed for it, such as a zero-balance request.
Maintaining control over the confirmation process
When performing external confirmation procedures, the auditor maintains control over:
- determining the information to be confirmed or requested
- selecting the appropriate confirming party
- designing the confirmation requests, including determining that requests are properly addressed and contain return information so that responses are sent directly to the auditor
- sending the requests, including follow-up requests where applicable, to the confirming party
The auditor, not the client, sends the request and receives the reply. The client may supply names and addresses, but the auditor tests where the information came from. This control is what makes the evidence reliable. Many firms use an electronic confirmation platform. That is allowed, but the auditor remains responsible for the control points above and for evaluating the reliability of the platform's process. Keep the platform's name and process description in the file.
Designing the request
Design affects the reliability and response rate. Considerations include:
- the assertions addressed
- specific identified risks of material misstatement, including fraud risks
- the layout and presentation of the request
- prior experience on the audit or similar audits
- the method of communication, such as paper or electronic
- management's authorization or encouragement to the confirming parties to respond
- the ability of the confirming party to confirm the requested information, for example a customer that records invoices by purchase order, not by balance
A positive request asks the recipient to respond in every case, either agreeing with the information or filling in the information. A blank form has the recipient supply the figure. A negative request asks for a response only if the recipient disagrees.
What if management refuses to let the auditor confirm?
If management refuses to allow the auditor to send a confirmation request, the auditor:
- inquires about management's reasons and seeks audit evidence about their validity and reasonableness
- evaluates the implications on the auditor's assessment of the relevant risks of material misstatement, including the risk of fraud, and on the nature, timing and extent of other audit procedures
- performs alternative audit procedures designed to obtain relevant and reliable evidence
If the auditor concludes that management's refusal is unreasonable, or cannot obtain relevant and reliable evidence from alternative procedures, the auditor communicates with those charged with governance under AU-C 260 and determines the implications for the audit and the opinion under AU-C 705. A refusal is a warning sign. It is not just an inconvenience.
Reliability of responses
If the auditor identifies factors that give rise to doubts about the reliability of a response to a confirmation request, the auditor obtains further audit evidence to resolve those doubts. If still not resolved, the auditor evaluates the effect on the assessment of the risks of material misstatement, including fraud, and on the nature, timing and extent of other procedures.
Factors that raise doubt include a response that did not come directly to the auditor, a response from someone other than the addressee, a reply that appears altered, or a reply from an unexpected address. Where a response is oral, the auditor asks for a written reply. Electronic and fax responses need checks of origin. Responses with disclaimers, such as "for information only, no responsibility is accepted", reduce the reliability the auditor can place on them.
Nonresponses and alternative procedures
If the auditor does not receive a response to a positive confirmation request, the auditor follows up where possible, then performs alternative audit procedures to obtain relevant and reliable evidence. For receivables, typical alternatives are examining subsequent cash receipts and matching them to specific invoices, inspecting shipping documents and customer purchase orders, and testing sales cutoff. For payables, they include vendor statements, subsequent disbursements and receiving records.
Alternative procedures should address the same assertion that the confirmation would have addressed. Checking that an invoice was recorded does not show that the customer owes it.
When a positive response is necessary
The auditor may determine that a response to a positive confirmation request is needed to obtain sufficient appropriate evidence. This may be where the information to be confirmed is available only from outside the entity, or specific risk factors such as fraud suggest that evidence from within the entity would not be reliable. If the auditor determines a positive response is necessary and it is not received, alternative procedures will not provide the needed evidence. The auditor then determines the implications for the audit and the opinion under AU-C 705.
Exceptions
An exception is a response that indicates a difference between the information requested to be confirmed and the information in the entity's records. The auditor investigates exceptions to determine whether they indicate misstatements. Exceptions often come from timing, such as payments in transit or goods in transit. Others are misstatements, and the auditor considers whether an exception indicates a fraud. Misstatements are accumulated under AU-C 450. If an exception projects across the population (for a sample), see AU-C 530.
Negative confirmations
Negative confirmations provide less persuasive evidence than positive ones. Under current AU-C 505, the auditor does not use them as the sole substantive procedure to address an assessed risk of material misstatement at the assertion level unless specified conditions are all present: a low assessed risk with sufficient evidence of operating effectiveness of relevant controls, a population of many small homogeneous items, an expectation of a very low exception rate, and no known circumstances that would make recipients disregard the requests. In most small and mid-size audits, those conditions are not all present, so negative requests are a supplement.
What does SAS 150 change?
AICPA and Journal of Accountancy summaries describe these changes:
- Cash and cash equivalents held by third parties. The most significant change is a new requirement for the auditor to perform external confirmation procedures for cash and cash equivalents held by third parties, unless certain conditions exist. The conditions are set out in the standard.
- Direct access. The standard recognizes direct access to information maintained by a knowledgeable external source as a way to meet external confirmation requirements, and gives related guidance.
- Intermediaries. The standard addresses the increasing use of intermediaries in confirmation procedures.
- Negative confirmations. The standard sets revised conditions for using negative confirmation requests.
- Related amendments. SAS 150 also amends SAS No. 142, Audit Evidence, as amended, and various other sections.
Effective date. SAS 150 is effective for audits of financial statements for periods ending on or after December 15, 2028. Early adoption is permitted. For a calendar-year client, 2028 is the first year it must apply.
Read SAS 150 itself for the exact wording before changing your confirmation procedures. If your firm does not now confirm cash, plan the audit programs and client communications that the change will need.
Documentation
The auditor documents the confirmation procedures: what was confirmed and with whom, the control over the process (who sent and received), the responses, follow-up on nonresponses and alternative procedures, the investigation of exceptions, and the conclusion. Keep a copy of the request as sent and each response received. See AU-C 230.
Practice observations on confirmations
Practice checks, not requirements of the standard. Gaps to avoid:
- Client staff mailing or emailing the requests
- Responses received through the client and filed as if they were direct
- Nonresponses with no alternative procedures documented
- Exceptions cleared with a note and no evidence
- Receivables not confirmed with no reason stated
- Bank confirmations that omit loans, guarantees or other relationships
Related
- Audit confirmations guide (AU-C 505)
- Bank confirmation letter template
- Accounts receivable confirmation letter template
- AU-C 330 responding to assessed risks
Sources
- AICPA, AU-C Section 505, External Confirmations
- AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained (receivables confirmation presumption)
- AICPA, Statement on Auditing Standards No. 150, External Confirmations (issued July 2026): AICPA announcement; Journal of Accountancy, July 2026
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error