PCAOB AS 2310: The Auditor’s Use of Confirmation

PCAOB AS 2310 sets the rules auditors of public companies follow when they use external confirmations to verify financial information. For audits of financial statements covering fiscal years that end on or after June 15, 2025, the standard requires auditors to confirm cash balances and accounts receivable directly with third parties, or to obtain equivalent evidence by accessing information held by a knowledgeable external source. It also dictates how the auditor keeps the client out of the process, when negative confirmations are acceptable, and what to do when responses never come back.¹

What Must Be Confirmed

Two categories of balances require direct third-party verification: cash held by outside institutions and accounts receivable arising from sales of goods or services, which includes loans held at financial institutions. For both, the auditor either sends confirmation requests or obtains equivalent evidence by directly accessing information a knowledgeable external source maintains. Viewing a bank balance through the institution’s secure online portal, for example, satisfies the requirement without a paper confirmation.¹

When choosing which cash items to verify, the auditor factors in the company’s cash management and treasury operations and the substance of its arrangements with third parties. If the auditor skips confirmation procedures for significant cash balances and does not directly access external records, the auditor must communicate that decision to the audit committee.¹

For accounts receivable, there is a narrow escape valve. If the auditor’s past experience with the company or similar engagements shows that confirmation responses simply do not come back, and the auditor expects the same result again, the auditor may skip confirmations and instead perform other substantive tests of details using external information obtained indirectly. That determination has to be documented.¹

Other Balances Worth Confirming

Beyond cash and receivables, the standard directs auditors to consider confirming other financial relationships with the same third party, based on the assessed risk of material misstatement. Four categories are named specifically:

Lines of credit, including whether the company has borrowing facilities available and on what terms.
Other indebtedness, meaning outstanding loans or obligations owed to the institution.
Compensating balance arrangements, where the company must keep deposits as a condition of a loan or credit line.
Contingent liabilities such as guarantees or other obligations tied to future events.¹

These items do not carry the same mandatory confirmation requirement as cash and receivables. The auditor uses professional judgment, weighing how likely it is that the balance could be materially wrong.

Positive and Negative Confirmation Requests

A positive confirmation asks the third party to respond whether or not they agree with the stated information. Some positive requests include the balance or transaction details for the recipient to verify. Others, called blank forms, leave the amount blank and ask the recipient to supply it. Blank forms tend to produce more reliable evidence because the third party pulls the number from their own records rather than confirming the auditor’s figure, but they demand more effort and usually generate lower response rates.¹

A negative confirmation asks the third party to respond only if they disagree. The evidence is weaker because silence could mean agreement, an unopened envelope, or a discarded email. Negative confirmations alone never provide enough evidence to address the risk of material misstatement. They can only supplement other substantive procedures, and only when three conditions are met: the risk of misstatement for the relevant assertion is low and the auditor has confirmed that relevant controls operate effectively; the population consists of many small homogeneous items; and the auditor expects few exceptions with a reasonable basis for that expectation.¹

Keeping the Client Out of the Process

The design principle running through the standard is that the auditor, not the client, controls every step. The auditor selects which items to confirm, sends the requests, and receives the responses. That structure prevents the company from steering confirmations toward friendly contacts or intercepting replies that reveal problems.¹

Requests must go directly to someone at the third-party organization who is knowledgeable about the information being confirmed. The auditor has to verify that each request is properly addressed so it reaches the right person at the right institution. Using a mailing address the client supplies, without independently verifying it, creates a gap a fraudulent company can exploit.

The auditor also populates the confirmation form using data pulled from the company’s accounting records, checking fields for account numbers, outstanding invoices, and dollar amounts against the audit workpapers. Handing that preparation work to company personnel defeats the point of controlling the process, so auditors handle it themselves.

Using Electronic Intermediaries

Auditors commonly use third-party platforms to send and receive confirmations electronically. AS 2310 permits it, with safeguards. Before relying on an intermediary, the auditor must understand its controls for preventing interception or alteration of requests and responses, determine whether those controls are designed and operating effectively, and assess whether the company can override those controls through financial relationships, ownership interests, contractual rights, or other arrangements.¹

If the intermediary’s controls are inadequate and the auditor cannot compensate with other procedures, or if the company can override those controls, the auditor must either send confirmations directly without the intermediary or switch to alternative procedures.¹

When Confirmations Do Not Come Back

Not every request produces a written reply. The auditor follows up when a response is missing, and if nothing arrives, the auditor performs alternative procedures. One trap: an oral response, such as a phone call from the third party confirming the balance, does not count. The standard classifies oral responses as nonresponses, so alternative procedures are still required.¹

The alternative procedures depend on the type of balance:

For cash, viewing the company’s account information directly on the financial institution’s secure website.
For accounts receivable, examining subsequent cash receipts and matching them to the invoices being paid, reviewing shipping documents, or inspecting other supporting records such as purchase orders or signed contracts.
For transaction terms or agreements, inspecting the signed contract and any amendments, comparing terms to industry norms, and verifying key details with other parties involved in the deal.
For accounts payable, examining subsequent cash disbursements, reviewing vendor correspondence, or inspecting other supporting documentation.¹

Each alternative procedure has to be documented thoroughly enough to show the auditor obtained sufficient evidence despite the missing confirmation.

Investigating Exceptions

A confirmation exception exists whenever the third party’s response differs from the information the auditor obtained from the company. The auditor must investigate each exception to determine whether it reflects a misstatement in the financial statements, a deficiency in internal controls, or both.¹

Not every discrepancy is a misstatement. Timing differences are common: a customer may have mailed payment before year-end that the company had not yet recorded, or goods may have been in transit. Investigation usually involves examining external information, which can include records the company received from knowledgeable outside sources. The auditor evaluates exceptions individually and in the aggregate to decide whether they point to a broader problem.¹

Where exceptions are widespread or the combined evidence from confirmations and alternative procedures is insufficient to support management’s assertions, the auditor may need to confirm additional items, perform more detailed substantive procedures, or reassess the risk of material misstatement for the affected accounts.

When Management Asks the Auditor Not to Confirm

AS 2310 itself does not directly address a management request to skip confirmation for certain accounts, but other PCAOB standards apply.² An unreasonable management restriction on confirming balances has to be communicated to the audit committee, and if the restriction limits the scope of the audit, the auditor may need to issue something other than a standard unqualified opinion.

A request to block confirmations also feeds into the auditor’s fraud risk assessment. A company that does not want its auditor speaking with third parties about account balances may be concealing something, and the auditor must consider whether the refusal represents a fraud risk factor, including management’s incentives and opportunities for fraudulent reporting, and respond accordingly.

Penalties for Falling Short

Auditors who fail to comply with AS 2310 face consequences through the PCAOB’s inspection and enforcement process. Under the Sarbanes-Oxley Act, the PCAOB can impose civil money penalties of up to $100,000 per violation for an individual and up to $2,000,000 for a firm. For intentional, knowing, or reckless conduct, those caps rise to $750,000 per individual and $15,000,000 per firm.³

Beyond money, the PCAOB can temporarily suspend or permanently revoke a firm’s registration, bar an individual from associating with any registered firm, impose practice restrictions, require additional professional education, or issue a censure. Suspension and revocation are reserved for intentional misconduct or repeated negligent violations.³ Confirmation procedures are among the most common deficiencies cited in PCAOB inspection findings.

1
Public Company Accounting Oversight Board. AS 2310: The Auditor’s Use of Confirmation
2
Public Company Accounting Oversight Board. The Auditor’s Use of Confirmation, and Other Amendments to PCAOB Standards
3
Office of the Law Revision Counsel. 15 USC 7215 – Investigations and Disciplinary Proceedings