Sample Audit Request Letter: Contents, Types, and Recipients

An audit confirmation letter is a formal written request an auditor sends to an outside party — a bank, customer, vendor, or lawyer — asking that party to independently verify financial information the client has reported. Under PCAOB Auditing Standard 2310, the response is used as audit evidence about account balances, loan terms, receivables, payables, and similar assertions in the financial statements.¹ The letter itself is short. What determines whether it produces usable evidence is what you put in it and how you handle the response.

What Every Confirmation Letter Must Contain

Four elements belong in every request, regardless of who receives it. Leave any of them out and you will either wait longer for a response or end up with evidence you cannot use.

Client Authorization

No bank, vendor, or law firm will release information about the client without written proof the client has authorized the disclosure. The standard approach is a signature from a senior client executive, typically the CFO or controller, either on the request itself or on a separate authorization letter that travels with it.² Electronic signatures are widely accepted; the federal E-SIGN Act treats them as legally equivalent to handwritten ones, and platforms such as Confirmation.com let the signer authorize and return the request digitally.

Precise Recipient Information

Address the letter to the specific department or individual that actually handles external audit requests at the recipient organization. At a bank, that usually means loan administration or deposit operations, not the branch manager. At a vendor, it means accounts receivable. Generic addressing sends the letter into internal routing, and internal routing is where confirmations get lost.

Specific Data Fields

State exactly what you are asking the recipient to verify. A bank request should list each account number, each loan number, and the cutoff date. A receivable request should include the client’s customer identification number at the vendor and the specific balance as of the confirmation date. Vague requests produce vague answers, or none. This matters especially for banks: the standard bank confirmation form developed jointly by the AICPA, American Bankers Association, and Bank Administration Institute is designed to confirm only what the auditor writes on it, so the bank has no obligation to volunteer information about accounts or loans you did not list.³ Omit a loan number and you will not hear about it.

Return Instructions Directly to the Auditor

The letter must clearly tell the recipient to send the response directly to the auditor, not back to the client. This is not optional. AS 2310 requires the auditor to keep control of the whole confirmation process, and a response that passes through the client’s hands is compromised evidence.¹ Include your firm’s mailing address, a secure fax number, or the URL of your electronic confirmation portal. Make this the most prominent instruction on the page.

Choosing Between Positive and Negative Confirmations

This choice shapes the wording of the letter and how much evidence you actually get back.

A positive confirmation asks the recipient to respond whether they agree with the stated balance or not. Some positive confirmations pre-fill the balance and ask the recipient to confirm or correct it. Others use a blank form and ask the recipient to fill in the balance themselves. Blank forms produce more reliable evidence because the recipient cannot simply glance at a figure and agree by default, but they take more effort and tend to yield lower response rates.¹

A negative confirmation asks the recipient to respond only if they disagree. Silence is treated as agreement, which is why the evidence is weaker: you cannot tell a verified balance apart from a letter that went in the trash. AS 2310 restricts negative confirmations to situations where all three of the following conditions are met:

The auditor has assessed the risk of material misstatement for the relevant assertions as low and has evidence that the client’s internal controls are designed and operating effectively.
The population consists of many small, homogeneous balances.
The auditor has a reasonable basis for expecting few disagreements.¹

Even when all three hold, negative confirmations by themselves are not enough. They have to be combined with other substantive procedures.

Tailoring the Letter to the Recipient

The core structure stays the same, but the fields and the ask differ depending on who is on the receiving end.

Bank Confirmations

A bank confirmation goes well beyond a checking balance. A single request typically asks the bank to verify deposit account balances, outstanding loan balances, interest rates, maturity dates, collateral pledged, and any guarantees or contingent liabilities as of the cutoff date.¹ Use the standard form and fill in every applicable field.

Accounts Receivable and Accounts Payable

Receivable letters go to the client’s customers and ask them to verify the amount owed as of a specific date. Payable letters go to the client’s vendors and ask them to confirm what the client owes them. Both are testing whether the reported balance actually exists and whether the amount is accurate.¹ Which format you choose — positive or negative — will depend on the factors described above.

Legal Inquiry Letters

Letters to the client’s outside lawyers work differently. Under AS 2505, management sends the letter to its lawyers, not the auditor directly, though the auditor drives the content and reviews the response. The letter should ask the lawyer to describe each pending matter, evaluate the likelihood of an unfavorable outcome, and estimate the potential loss or range of loss, and it should cover unasserted claims that management considers probable of being asserted and that could result in an unfavorable outcome.²

Expect the lawyer to push back on broad, open-ended questions. Under the American Bar Association’s Statement of Policy, lawyers are not obligated to respond to sweeping requests about every possible legal contingency; disclosure is limited to matters the lawyer has actually worked on, and even then the lawyer may resist evaluating potential liability because an adverse party could treat the evaluation as an admission.⁴ Draft the letter to reference the specific matters management has already identified, not a blanket inquiry.

Keeping Control of the Process

This is where most confirmation-related audit deficiencies come from. AS 2310 requires the auditor to control every step: selecting which items to confirm, preparing the requests, transmitting them, and receiving the responses.¹ In practice, the client signs the authorization and then steps back. The auditor addresses the envelopes, mails them, and provides the return address.

Electronic confirmations through an intermediary platform are common now, but they carry their own control requirement. The auditor has to evaluate whether the intermediary’s controls adequately protect against interception, whether those controls are operating, and whether the client has any relationship with the intermediary that could let it override those protections.¹ If the platform fails any of those tests, you cannot use it.

After the Letters Go Out

Build a tracking log the day the letters leave. Record the date each request was sent, the recipient, the balance or item being confirmed, and the target date for a response. That log is part of your workpapers and it is how you manage the flow of evidence.

When a positive confirmation goes unanswered, AS 2310 requires follow-up.¹ Most firms send a second request within two to three weeks, sometimes through a different channel such as email. Waiting longer compresses the time available for alternative procedures and can push back the audit opinion.

When a response arrives, compare the confirmed amount to the client’s records. If they agree, document and move on. If they disagree, you have an exception. The most common cause is timing: a customer mailed a payment before year-end and the client posted it after, so the two records disagree at the cutoff. Trace the cash movement to the correct period and the exception usually resolves. Others point to real misstatements, and AS 2310 requires you to evaluate each one to decide whether it signals a misstatement affecting the financial statements, a control deficiency, or both.¹ A pattern of exceptions across multiple confirmations means the original risk assessment was probably too optimistic.

When a positive confirmation is never returned, or a response is unreliable because it came back through the client, perform alternative procedures aimed at the same assertion. For receivables, that commonly means examining post-year-end cash receipts matched to specific invoices, shipping documents, or signed contracts and purchase orders. For payables, examining post-year-end cash disbursements, vendor correspondence, or other supporting documentation.¹

One situation deserves its own attention. If management asks you not to send a confirmation to a particular customer or vendor, evaluate the reason. A legitimate concern about a sensitive relationship can justify skipping that one recipient, provided you perform alternative procedures and consider what the request means for your overall risk assessment. A refusal without a reasonable explanation is a different matter: consider whether it amounts to a scope limitation affecting the audit opinion. A blanket refusal to allow any confirmations is almost impossible to justify and raises serious questions about management integrity.

1
Public Company Accounting Oversight Board. AS 2310 – The Auditors Use of Confirmation
2
Public Company Accounting Oversight Board. AS 2505 – Inquiry of a Clients Lawyer Concerning Litigation Claims and Assessments
3
AICPA. Standard Form to Confirm Account Balance Information with Financial Institutions
4
Public Company Accounting Oversight Board. Exhibit II – American Bar Association Statement of Policy Regarding Lawyers Responses to Auditors Requests for Information