A bank confirmation audit procedure is a letter or electronic request an auditor sends directly to a client’s financial institution to independently verify cash balances, loan obligations, and other banking relationships reported in the client’s financial statements. Because the response comes from an outside party with no stake in making the client look good, auditors treat it as some of the most reliable evidence they can gather. Under PCAOB Auditing Standard AS 2310, auditors of public companies are expected to confirm cash and cash equivalents held by third parties or otherwise obtain evidence by directly accessing the institution’s records.1Public Company Accounting Oversight Board. AS 2310 – The Auditors Use of Confirmation
What the Bank Is Asked to Confirm
The request casts a wide net. The bank is asked to verify the balance of every deposit account the client holds, including checking, savings, and certificates of deposit. Those figures let the auditor test whether cash and equivalents on the balance sheet actually exist and are stated at the right amount.
Loan details carry equal weight. The bank reports the outstanding principal as of the confirmation date, the interest rate, the maturity date, repayment terms, and any collateral the client pledged to secure the debt. Collateral information tells the auditor which assets are encumbered and need separate disclosure.
The confirmation also targets items that may not appear on the balance sheet at all. Guarantees the client has extended to third parties and letters of credit the bank issued on the client’s behalf are potential obligations that must be disclosed even though no payment has been made. Compensating balances, meaning minimum deposits the client has to maintain as part of a lending arrangement, restrict available cash and need disclosure too. The bank is also asked about any unused lines of credit and their terms.
There is one important limitation. The standard form is not designed to flush out information the auditor didn’t ask about. If the client has a secret account or an undisclosed loan at the same bank, the confirmation will only catch it if the bank volunteers the detail or the auditor specifically inquires.
Positive, Negative, and Blank Confirmation Requests
Not all confirmation requests work the same way, and the type an auditor chooses depends on how much risk surrounds the account.
- A positive confirmation requires the bank to respond whether it agrees or disagrees with the information on the request. This is the default for banking relationships because it produces a definitive answer. Silence tells the auditor something needs follow-up.
- A negative confirmation asks the bank to respond only if it disagrees with the stated information. Silence is treated as agreement. Auditors use this approach when the risk of misstatement is low and the number of accounts is large, but it has an obvious weakness: a non-response from a bank that actually verified the figures looks the same as a non-response from a bank that ignored the request.
- A blank confirmation is a variation on the positive form where the auditor leaves the balance field empty and asks the bank to fill it in. Because the bank has to look up the actual number rather than agree with a figure already printed on the page, blank confirmations generally produce stronger evidence.
Bank confirmations almost always use the positive form. The stakes around cash and debt balances are too high for the ambiguity that comes with negative confirmations.
The Standard Confirmation Form
Most bank confirmations in the United States follow a standardized template jointly developed by the American Bankers Association, the AICPA, and the Bank Administration Institute, which the AICPA distributes as a fillable PDF. The template has two sections. The first covers deposit accounts and asks the bank to confirm account numbers, types, and balances. The second covers loans and asks for outstanding balances, interest rates, maturity dates, and collateral descriptions. The auditor fills in the client’s information, and the bank either confirms it or provides corrections. Using the standard layout helps bank personnel process requests quickly because they see the same form from every audit firm.
How Auditors Keep Control of the Process
The entire value of a bank confirmation depends on the auditor controlling every step. If the client could alter the request or intercept the response, the evidence would be worthless. AS 2310 is explicit: the auditor selects the items to confirm, sends the request directly to the bank, and receives the response directly from the bank. After signing the authorization letter, the client never handles the confirmation again.
Client Authorization
The process starts with the client signing an authorization letter that accompanies the request. The letter tells the bank the client consents to releasing account information to the auditor. Federal law actually permits banks to share this information with a client’s auditors without needing special consent. The Gramm-Leach-Bliley Act includes a specific exception allowing financial institutions to disclose nonpublic personal information to the institution’s “attorneys, accountants, and auditors.”2Office of the Law Revision Counsel. 15 USC 6802 – Obligations With Respect to Disclosures of Personal Information Even so, banks typically won’t process a confirmation without seeing the client’s written authorization, and auditing standards treat obtaining it as a required step.
Electronic Versus Paper Delivery
Auditors used to mail paper confirmation forms to the bank and wait for a signed response in a sealed envelope. That method works but introduces real risks. Mail gets lost. Responses get delayed. Fraudsters have forged bank letterhead and fabricated responses.
Electronic platforms have largely replaced paper for major audit firms. Confirmation.com, which processes confirmations for over 175,000 audited entities across more than 100 countries, connects auditors and banks through a secure digital portal.3Commodity Futures Trading Commission. Confirmation.com – Secure Confirmation Clearinghouse The auditor submits the request electronically, the bank responds through the same system, and the platform creates an audit trail that makes interception or tampering far harder than paper allowed.
Routing the Request
The confirmation needs to reach someone at the bank with access to the client’s full relationship, not just a branch manager who sees one account. Most banks have centralized confirmation departments that handle these requests, and directing the request there avoids partial responses that miss loan accounts or contingent liabilities.
Evaluating the Response
When the confirmation comes back, the first job is checking that it is genuine. For paper responses, that means looking for official letterhead and an authorized signature. For electronic responses, the platform authenticates the source, which is one reason electronic confirmations have become the norm.
The core work is comparing every confirmed figure against the client’s own records. Deposit balances get traced to the cash accounts in the general ledger. Loan details get matched against debt schedules and interest calculations. Any contingent liabilities or compensating balances the bank reports have to appear in the client’s disclosures.
Handling Differences
The bank balance and the client’s book balance will almost never match exactly, and that is usually fine. The most common differences are timing items. Deposits in transit are amounts the client sent that the bank hasn’t posted yet. Outstanding checks are payments the client issued that recipients haven’t cashed. Both appear on the client’s bank reconciliation and explain themselves with supporting documentation.
Differences that can’t be explained by timing are a different story. A material unexplained gap requires investigation. The auditor traces the discrepancy to specific transactions and resolves it to zero or to an amount small enough not to matter. If it can’t be resolved, it becomes a potential misstatement that affects the audit opinion.
Checking for Completeness
The auditor also confirms that the bank’s response covers every account and relationship listed in the original request. A response that says “no exceptions noted” still needs scrutiny to make sure it actually addresses every deposit account, every loan, and every contingent item. If anything is missing, the auditor follows up until the bank addresses it or performs alternative procedures.
When the Bank Doesn’t Respond
Banks don’t always reply, and a missing response doesn’t let the auditor skip the account. AS 2310 requires the auditor to perform alternative procedures for any item that didn’t get confirmed, and to reconsider whether the lack of response changes the risk assessment for the engagement, including fraud risk.1Public Company Accounting Oversight Board. AS 2310 – The Auditors Use of Confirmation
The first step is usually a second request to the bank’s confirmation department. If that also goes unanswered, the auditor turns to substitute procedures that depend on what was being confirmed.
Alternative Procedures for Cash
For deposit balances, one option under AS 2310 is viewing the account information directly on the bank’s secure website. Beyond that, the auditor typically examines bank statements from the period after the balance sheet date, looking for clearance of outstanding checks and posting of deposits in transit. Tracing large receipts and disbursements from those subsequent statements back to the accounting records provides indirect evidence that the account exists and the balance is accurate. The auditor also reviews the client’s bank reconciliation as of the balance sheet date.
Alternative Procedures for Loans and Other Liabilities
When loan confirmations go unanswered, the auditor inspects the signed loan agreements and promissory notes to verify principal amounts, interest rates, and repayment terms. Analyzing the client’s interest expense schedule and tracing payments to cash disbursement records offers indirect evidence that the liability is real. The auditor also reviews board of directors’ minutes for authorization of new debt or credit facilities, and reads correspondence between the client and the bank for any unconfirmed guarantees or contingent liabilities.
Why Bank Confirmations Matter for Fraud Detection
Bank confirmations exist partly because client-generated documents can be faked. A dishonest management team can forge bank statements, fabricate deposit slips, or create fictitious accounts that look legitimate on paper. Going straight to the bank bypasses all of that.
Some of the largest corporate frauds in history involved inflated or fictitious cash. Parmalat grew a fake cash account to nearly $5 billion over roughly a decade. HealthSouth’s senior accounting personnel created false documents supporting cash accounts that were overstated by a combined $300 million.4Commodity Futures Trading Commission. How Auditors Can Overcome Confirmation Fraud Challenges In both cases, properly executed confirmations sent through independent channels would have exposed the discrepancies much sooner.
The confirmation process itself isn’t immune to manipulation, though. Fraudsters have impersonated bank employees, set up fake websites that mimic real financial institutions, and intercepted paper confirmations before they reached the auditor. Those risks are exactly why auditing standards put so much weight on auditor control over the process, and why electronic platforms with built-in authentication have become standard practice. When a request moves through a verified digital channel to the bank’s registered portal, the openings for interception shrink considerably compared with dropping an envelope in the mail and hoping it lands on the right desk.