What Is an Audit Confirmation? Types, Process, and Penalties

An audit confirmation is a written request that an auditor sends directly to an outside party — such as a bank, customer, vendor, or law firm — asking that party to verify financial information reported by the company being audited. Because the response comes from someone independent of the business, it counts as one of the most reliable forms of audit evidence available. The Public Company Accounting Oversight Board codifies the process in Auditing Standard 2310 for public company audits, and the AICPA’s AU-C Section 505 governs the same process for private company audits.¹

The Three Formats an Auditor Can Send

Auditors pick from three confirmation formats depending on how much risk the account carries and how strong the evidence needs to be. Each format asks something different of the recipient, and that difference is what determines how much weight the auditor can put on the response.

Positive Confirmations

A positive confirmation asks the recipient to respond regardless of whether they agree with the stated balance. If the company says a customer owes $47,000, that customer must write back either confirming the amount or explaining why their records differ. Silence is never treated as agreement, which is what makes this format stronger. AS 2310 calls for positive confirmations on significant accounts or when the risk of material misstatement is elevated.¹

Negative Confirmations

A negative confirmation reverses the logic. The recipient only writes back if they disagree, and no response means the amount is accepted as correct. This format is allowed only under narrow conditions: the combined risk of misstatement is low, the population consists of a large number of small balances, and the auditor has no reason to think recipients will ignore the request.²

The weakness is obvious. There’s no way to tell whether a nonresponse means the recipient checked their books and agreed or simply tossed the letter. For that reason, negative confirmations alone don’t count as sufficient audit evidence, and auditors can only use them to supplement other substantive testing.²

Blank Confirmations

A blank confirmation is a variation of the positive format with the balance field deliberately left empty. Instead of asking whether the recipient agrees they owe $47,000, the form asks what balance their records show. The recipient fills in the number from their own books, and the auditor compares it to what the client reported. Because it’s harder to rubber-stamp than a pre-populated form, AS 2310 treats a blank form as capable of providing more reliable evidence than one that already includes the figure being confirmed.¹

The tradeoff is response rate. Many recipients don’t want to dig through their records when a quick check-the-box would be easier, so blank forms come back less often. Auditors weigh evidence quality against the odds of a timely reply when choosing between blank and pre-populated positive confirmations.

Who Receives Confirmation Requests

Confirmations go out to every major category of outside party that deals financially with the company. Each recipient verifies a different piece of the balance sheet.

Banks and Financial Institutions

Banks are the most frequent recipients. They confirm checking and savings balances, outstanding loan principal, interest rates, maturity dates, lines of credit, and any collateral pledged against debt. A bank’s response usually states the balance as of a specific date, the interest rate in effect on that date, and the last date through which interest was paid.¹

Customers and Vendors

Customers get requests to verify how much they owe the company for goods or services already delivered. This step is what catches inflated receivables, one of the classic red flags for revenue fraud. On the other side, vendors confirm what the company owes them, which helps auditors detect understated payables that would otherwise flatter the balance sheet.

Legal Counsel

Lawyers receive a different kind of confirmation, called an audit inquiry letter, asking about pending or threatened litigation, potential claims, and the lawyer’s view on likely outcomes. The response feeds directly into whether the company records or discloses loss contingencies in its financial statements.³

Lawyer responses come with built-in limits. Under the American Bar Association’s Statement of Policy, attorneys typically furnish information only as of a specified date and disclaim any duty to update the auditor about developments afterward. Many firms also limit their reply to matters that existed at or after the end of the fiscal period, so issues resolved during the year may not appear at all.⁴

How the Process Actually Works

The confirmation process rests on one principle: the auditor controls everything. Once the client signs the authorization letter, the company being audited doesn’t touch the request again. The confirmation loses its value as independent evidence the moment the client has an opportunity to intercept or alter it.

The auditor decides which items to confirm, prepares or reviews the requests, sends them directly to the confirming party, and receives the responses directly back. AS 2310 is explicit that both the outgoing request and the incoming response must flow through the auditor, not the client.¹

If a confirming party mistakenly sends the response to the client, the auditor must contact that party and ask them to resend it directly.¹

Before anything goes out, the auditor pulls the specific data from the client’s general ledger and subsidiary records: the exact balance as of the balance sheet date, account numbers, and the names of all parties. Debt confirmations also include loan terms, interest rates, maturity dates, and collateral. Names and addresses on the form must match the company’s vendor or customer files, and balances must tie to the subsidiary ledger. Sending a confirmation with the wrong information defeats the whole purpose.

Electronic Confirmation Platforms

Paper confirmations with pre-addressed return envelopes were once the standard method. That era is largely over. Electronic platforms now handle the bulk of audit confirmations, particularly bank confirmations. These systems use encrypted channels to transmit requests and responses, track who supplied the data, and cut out the logistical problems of lost mail and second mailings. AS 2310 permits intermediary platforms for electronic transmission as long as the communication still flows directly between the auditor and the confirming party.¹

Platforms also let auditors set requests up during planning, weeks before year-end, with actual transmission triggered on the balance sheet date. Prior-year information carries over on recurring audits, so only the changed details need updating. The efficiency gain is real, but the requirement that the auditor maintain control end-to-end does not change.

When Responses Don’t Match the Books

A confirmation exception is any case where the responding party’s information doesn’t match what the auditor got from the client. The bank reports a loan balance $200,000 higher than the client’s books show. A customer says they owe $15,000 when the receivable is recorded at $28,000. These gaps aren’t automatically problems, since timing differences, payments in transit, and disputed invoices can all cause legitimate discrepancies. But every exception has to be run down.

AS 2310 requires auditors to evaluate each exception and decide whether it points to a misstatement affecting the financial statements, a deficiency in internal controls, or both.¹

Patterns matter here. A single exception in accounts receivable is often a clerical error. But when customers consistently report lower balances than the company’s books show, that pattern can signal channel stuffing, premature revenue recognition, or fictitious sales. A cluster of exceptions in the same direction usually triggers expanded testing.

What Happens When No One Responds

Not every recipient replies. Some ignore the request, some return it undelivered, and some write back saying they can’t or won’t provide the information. Under AS 2310, all of these outcomes count as nonresponses to a positive confirmation, and the auditor has to follow up with the confirming party.¹

When follow-up still produces nothing, the auditor moves to alternative procedures — different tests designed to verify the same assertion through other evidence. What those look like depends on the account:

For accounts receivable, the auditor examines cash receipts collected after the balance sheet date and traces them to the specific invoices at issue. Shipping documents and signed delivery receipts can also confirm that goods actually reached the customer.
For accounts payable, the auditor reviews payments made after year-end, matches them to underlying vendor invoices, and compares purchase orders with receiving documents to confirm the company actually got what it’s claiming to owe for.
For bank balances, the auditor obtains bank statements directly and reconciles them to the client’s general ledger. Cutoff statements covering the period right after year-end help catch deposits in transit and outstanding checks.

Alternative procedures work as a safety net, not a shortcut. The auditor still has to document why the confirmation failed and assess whether the inability to confirm raises additional risk that the account is misstated.

Penalties for Falsifying a Confirmation

Confirmations become part of the permanent audit workpapers, and federal law imposes serious consequences for tampering with them. Under 18 U.S.C. § 1519, anyone who knowingly falsifies a record or document with intent to obstruct a federal investigation faces up to 20 years in prison, a fine, or both.⁵

A separate provision, 18 U.S.C. § 1520, addresses the workpapers directly. Any accountant who audits a public company must retain all audit and review workpapers for at least five years after the end of the fiscal period. Knowing and willful violation of this requirement carries up to 10 years in prison.⁶

These penalties reach everyone in the chain: the auditor, a company officer who intercepts and alters a confirmation before it reaches the bank, and a third party who provides a knowingly false response. The statutes are designed so the cost of falsification vastly outweighs whatever short-term gain someone might imagine from hiding a liability or inflating an asset.

1
Public Company Accounting Oversight Board. AS 2310: The Auditor’s Use of Confirmation
2
Federal Register. PCAOB Notice of Filing of Proposed Rules on the Auditor’s Use of Confirmation
3
American Bar Association. Report on Audit Response Timing Issues
4
American Bar Association. Statement on Updates to Audit Response Letters
5
Office of the Law Revision Counsel. 18 U.S. Code 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations and Bankruptcy
6
Office of the Law Revision Counsel. 18 U.S. Code 1520 – Destruction of Corporate Audit Records