ISA 505 – External Confirmations

5 Responses to confirmation requests

If auditor finds confirmation to be suspicious and its reliability is doubtful then auditor shall seek additional audit evidence to clear the doubts.

If auditor concludes that response to confirmation is not reliable then he shall determine what changes are necessary in terms of nature, timing and extent of additional audit procedures and also assess if assessment of risk of material misstatement needs revision.

The doubts may arise if:

  1. Confirmation was received indirectly
  2. Management was involved in the receipt process
  3. Confirmation is not from the intended source or person
  4. Confirmation is sent by an unauthorized person
  5. Confirmation has been compromised during transmission

The auditor may have to alter or perform additional procedures to address such issues. Examples include:

  1. Confirming the source by contacting the party on telephone
  2. In case of indirect response, auditor may ask to write directly or send an email of the letter sent by the party so that auditor can compare

Oral representation by the third party does not amount to external confirmation as it cannot be filed as evidence by the auditor. However, for example, while inquiring the third party auditor may ask the party to write directly to the auditor the same that has been expressed orally.

But even after all the possible measures have been taken and still the confirmation is unreliable, auditor shall determine if current risk assessment is still valid as it may be indicative of possible fraud.

In case no response is received auditor may send follow-up requests. However, if there is still no response then auditor shall apply alternative audit procedures to obtain audit evidence.

In some cases a response is necessary (only possible in case of positive request). For this auditor try his level best to obtain evidence through alternative procedures. If alternative procedures will not provide evidence and third party does not respond then auditor shall assess if modification is necessary in auditor’s report.

It may happen that information sent by the third party is different from the information auditor already have. In this case auditor shall determine if such exceptions are due to fraud or error and check if additional procedures are required.

6 Evaluation of responses

The auditor shall evaluate if the responses to confirmation request provide sufficient appropriate audit evidence or additional procedures are required.

As discussed above auditor categorizes the responses received as follows:

  1. Appropriate response served by an appropriate party
  2. Unreliable response
  3. Response with exceptions
  4. No response

Such categorization help auditor evaluate if evidence obtained is relevant and reliable in given circumstances.