How to Fill Out and Submit a Bank Audit Confirmation Form

To fill out a bank audit confirmation form, enter the client’s deposit and loan account details in the top (customer) half of the AICPA Standard Form to Confirm Account Balance Information with Financial Institutions, have the account’s authorized signer sign the authorization, and submit the request directly to the bank — for most large U.S. banks, that means uploading it through Confirmation.com rather than mailing it. The bank fills in the bottom half and sends the completed form back to the auditor.¹

Where to Get the Form

The AICPA hosts the standard form as a free downloadable PDF; you need a free AICPA account to reach it. One template covers both deposit accounts and loan accounts on a single page.¹ If you submit through Confirmation.com, the platform generates its own digital version, but the fields mirror the paper template. Some auditors still download the PDF for reference or for the occasional bank that accepts mailed requests.

What to Gather Before You Start

The form has two halves. The auditor fills in the top from client-supplied data; the bank completes the bottom. Before you touch either the PDF or the Confirmation.com form, get these items from the entity being audited:

Account numbers and names for every checking, savings, certificate of deposit, and money market account held at that bank.
Loan details: account numbers, outstanding balances, due dates, interest rates, the date through which interest has been paid, and a description of any collateral pledged.²
The “as of” date — the balance-sheet date for which the bank should report figures. Usually the last day of the fiscal year or quarter under audit.³
The authorized signer’s name, title, and email — exactly as they appear in the bank’s records. A mismatch here is one of the most common reasons banks reject confirmation requests.

One boundary worth noting up front: the form is not designed to surface information you didn’t ask about.¹ If the company has a dormant account or an undisclosed line of credit that never makes it onto the form, the bank is not expected to volunteer it. Suspected unreported accounts call for separate audit procedures.

Filling In the Customer Section

Start with the deposit block. For each account, enter the account number, the account name as it appears on the bank’s records, the interest rate, and the balance as of your chosen date. If you don’t have a balance figure when you prepare the form, leave the field blank and let the bank fill it in.²

The loan block follows the same pattern with more detail: balance owed, due date, interest rate, date through which interest has been paid, and a description of any collateral. List each loan on its own line if the entity has more than one at the same bank. Below both blocks is a signature line for the customer — this is where the authorized signer signs, dates, and gives their title.

Blank Balances or Pre-Filled?

Two approaches, and the choice affects audit quality. A form with pre-filled balances asks the bank to confirm or note exceptions — a positive confirmation. A form with blank balance fields asks the bank to fill in the figures from scratch — still a positive confirmation, but a stricter variant. Blank forms reduce the risk that a bank employee signs off without actually checking the records.⁴ The auditor decides which format the engagement calls for. If you’re preparing data on the client side, ask before you start.

Getting the Authorization Signed

The customer’s authorized signature is the linchpin of the whole request. Without it, the bank rejects the form. Under the Gramm-Leach-Bliley Act, banks may disclose nonpublic personal information to their client’s auditors as an exception to the standard privacy rules, but in practice, banks still require the signed customer authorization before releasing any data.⁵

On Confirmation.com, authorization runs electronically. The auditor enters the signer’s email, the platform sends the request, and the signer clicks through to sign digitally.⁶ Under the federal E-SIGN Act, an electronic signature cannot be denied legal effect solely because it’s electronic, so the digital authorization carries the same weight as a wet signature.⁷

Two rules to respect: the signer’s name and email must match the bank’s records, and authorization can’t be delegated. If the CFO is the signer on file, an assistant cannot sign in their place.

Submitting Through Confirmation.com

Most large U.S. banks now require audit confirmations to come through Confirmation.com and nothing else. JPMorgan Chase accepts requests through the platform for deposit accounts, lines of credit, letters of credit, loan accounts, and several other account types.⁸ Wells Fargo routes auditors to the same platform for deposits, commercial loans, business lines, and foreign currency accounts.⁹ HSBC Innovation Banking states it can only accept confirmation requests through Confirmation.com.¹⁰

The submission workflow runs in five steps:

Create a client profile. Enter the company’s legal name and the authorized signer’s name and email, matching the bank’s records.
Add accounts. Select “Financial” as the confirmation type, search for the responding bank, and choose the form type (asset, liability, or consolidated).
Request client authorization. The platform emails the authorized signer, who signs the authorization digitally.
Set the as-of date and initiate. Enter the balance-sheet date, select which accounts to confirm, and pay the per-request fee by credit card.
Download the completed confirmations. When the bank responds, you get an email notification and can pull the finished forms into your workpapers.⁶

Exact pricing isn’t publicly listed and depends on confirmation type and volume, so check the platform’s current fee schedule before you initiate.

Small Banks That Still Take Paper

Community banks and credit unions may still accept mailed forms. Send the request to the bank’s centralized audit or confirmations department rather than a local branch; the correct address usually appears on the bank’s website under audit confirmations or verification services. Use a tracked delivery method, because a lost request can hold up an entire audit.

After You Submit

Once the bank has the request, staff verify the signer, match account numbers to internal records, and either confirm the balances or note exceptions in the “Exceptions and/or Comments” section on the bottom half. Wells Fargo estimates five to seven business days.⁹ Chase’s standard service level is ten business days, though missing information or internal dependencies can stretch that.¹¹

The bank’s response includes a statement that the customer-provided information agrees with its records and that no other deposit or loan accounts came to its attention during the process.² The completed form goes directly to the auditor, never back through the client, so the verification stays independent.

Why Banks Reject Requests

Rejections are more common than most preparers expect. The usual causes:

The company name on the form doesn’t match the bank’s records. Even “Corp.” versus the spelled-out “Corporation” can trip a rejection.
Account numbers are wrong or missing, so the bank can’t locate the account.
The person who signed the authorization isn’t on file as an authorized signer for that account.
The form is incomplete: missing dates, missing signatures, blank required fields.

Confirmation.com notifies the auditor of the reason when a request is denied. Fixing the issue and resubmitting is straightforward but eats into the audit timeline.

When the Standard Form Isn’t Enough

The standard form covers deposit and loan balances. Larger engagements often involve items it wasn’t built for: derivatives, letters of credit, guarantees, and compensating balance arrangements. These need separate or supplementary confirmation procedures.

For derivatives and hedging instruments, auditors evaluate five categories of assertions — existence, completeness, rights and obligations, valuation, and presentation and disclosure — which a standard bank confirmation won’t capture.¹² Expect customized confirmation requests or third-party valuation work instead.

For guarantees, the Federal Reserve’s examination procedures call for confirmation forms that include the account party’s name, guarantee number, amount, fee charged, and a description of any collateral or counter-guarantee held.¹³ If the company has issued or received guarantees through the bank, plan on gathering that information alongside the standard deposit and loan data.

PCAOB standards also flag the confirmation process as a place to test for fraud, specifically noting that auditors should consider confirming the absence of undisclosed side agreements and verifying the terms of any that exist.¹⁴ A company that claims no outstanding loans at a bank, met by a bank response listing an active credit line, is exactly the mismatch the confirmation form exists to catch.

1
AICPA & CIMA. Standard Form to Confirm Account Balance Information with Financial Institutions
2
Federal Reserve Services. Standard Form to Confirm Account Balance Information with Financial Institutions
3
Federal Reserve Services. Audit Confirmation Request Form
4
Public Company Accounting Oversight Board. The Confirmation Process
5
FDIC. Gramm-Leach-Bliley Act – Privacy of Consumer Financial Information
6
Confirmation.com. Confirmation.com Auditor User Guide
7
Office of the Law Revision Counsel. United States Code Title 15 Section 7001
8
Confirmation.com. Chase Audit Confirmation Instructions
9
Wells Fargo. Verification of Deposit
10
HSBC Innovation Banking. Audit Confirmation
11
Chase. Global Audit Confirmations
12
Public Company Accounting Oversight Board. Auditing Derivative Instruments, Hedging Activities, and Investments in Securities
13
Federal Reserve. Section 3300.1
14
Public Company Accounting Oversight Board. Consideration of Fraud in a Financial Statement Audit