What Is Balance Confirmation in Financial Auditing?

A balance confirmation in auditing is a formal request an auditor sends to an independent third party — a bank, customer, supplier, or lender — asking them to verify, in writing, that a specific dollar figure on the client’s books matches what their own records show as of a stated date. The response either backs up the number or flags a difference that has to be explained. The reason auditors rely on this check so heavily is straightforward: the evidence comes from someone outside the company, someone who has no reason to help the books look better than they are.

Why Auditors Use Balance Confirmations

The principle behind the process is that evidence from an independent outside source is more trustworthy than evidence the company produced itself, and evidence the auditor receives directly is more reliable than evidence that passes through someone else’s hands. The AICPA’s professional standards framework states this directly.¹

The accounts most commonly confirmed are cash held at financial institutions, accounts receivable owed by customers, outstanding loans, and accounts payable owed to suppliers. Receivables get special treatment under auditing standards: there is a presumption that the auditor will confirm accounts receivable unless the balances are immaterial, confirmations would be ineffective, or other testing already reduces risk to an acceptable level.² Cash confirmations are near-universal in practice. Payables confirmations often focus on completeness instead of existence, because the real risk with debts is that some have been left off the books entirely.

A signed confirmation arriving directly from a bank gives the auditor strong evidence that reported funds are real. That same third-party check helps catch deliberate manipulation, such as inflated cash balances or hidden liabilities.

The Three Types of Confirmation Requests

Confirmation requests come in three forms, and each one fits a different risk profile.

Positive Confirmations

A positive confirmation asks the recipient to respond regardless of whether they agree with the stated balance. Auditors use this approach when individual balances are large or the risk of a significant error is elevated. Silence is not acceptance; a non-response triggers follow-up work.³

Blank Confirmations

A blank confirmation is a variation of the positive form. The amount field is left empty, and the recipient fills it in from their own records. Response rates tend to be lower because the recipient has to do more work, but the evidence is stronger since no one can simply glance at a pre-filled number and sign off.³

Negative Confirmations

A negative confirmation asks the recipient to respond only if they disagree with the stated balance. Silence counts as agreement. This method is limited to situations involving a high volume of small balances where the risk of material error is low and internal controls are already known to be working. Retail bank accounts and minor trade payables fit the profile. The obvious weakness: no response does not actually prove anything, so negative confirmations work only when the underlying numbers already look trustworthy.²

What a Confirmation Request Contains

Every request has to include enough information for the recipient to find the right records. At a minimum, that means the legal name of the account holder, the account or identification number, and the “as of” date being verified.⁴ Positive confirmations state the balance from the company’s books; blank confirmations leave that field empty.

Most bank confirmations use a standardized template jointly approved by the AICPA, the American Bankers Association, and the Bank Administration Institute. The form covers both deposit account balances and loan balances.⁵ Recognized templates get processed faster because the receiving bank’s staff know what to look for.

The request has to carry the signature of someone authorized to release the account information. The Federal Reserve’s own audit confirmation form, for example, requires the signer to appear on the institution’s Official Authorization List.⁴ Without that authorization from the account holder, banks generally will not share account details with an outside auditor.

How the Request Travels

The auditor keeps control of the entire process from start to finish. Under PCAOB Auditing Standard 2310, the auditor selects the items to confirm, sends the requests, and receives the responses. The confirmation goes directly to the third party. The response comes directly back to the auditor.³ The client’s hands never touch either piece. If they did, the numbers could be altered before the auditor saw them.

Paper confirmations should go by a method that provides proof of delivery, such as certified mail. Most confirmation traffic, though, has moved to electronic platforms. Confirmation.com routes requests directly from auditors to validated responding parties at banks, law firms, and suppliers, verifies the identity of both sides, and blocks the client from intercepting or modifying anything in transit.⁶ Electronic responses also come back faster, typically within one to five days.

When an auditor uses an electronic intermediary, AS 2310 requires them to evaluate whether the platform’s controls actually protect the integrity of the evidence, and whether the client has any relationship with the intermediary that could allow it to override those safeguards.³

Judging Whether a Response Can Be Trusted

Not every response deserves the same weight. AS 2310 requires the auditor to consider whether the person or institution responding is actually knowledgeable about the information, willing and able to respond accurately, and free from bias toward the company being audited.³ A confirmation signed by the operations department of a major national bank is strong evidence. A confirmation from a related party or a small entity with close ties to the client deserves much more scrutiny.

Incentives matter too. A vendor in a dispute with the client might overstate what the client owes. A related-party lender with an interest in making the client’s balance sheet look healthy might confirm a balance that does not reflect the real substance of the arrangement. These responses are not useless, but the auditor needs corroborating evidence from other sources before relying on them.

When Responses Don’t Come Back

A non-response to a positive confirmation is not evidence that the balance is right. The auditor has to perform alternative procedures to get enough evidence to form a conclusion. AS 2310 gives specific examples of what those procedures look like:³

For cash, verify account information directly through a secure website maintained by the financial institution.
For accounts receivable, examine cash payments received after the confirmation date and trace them to specific invoices, review shipping documents, or inspect purchase orders and signed contracts.
For accounts payable, review cash disbursements made after the balance sheet date, examine correspondence from the vendor, or inspect other supporting records.
For transaction terms, inspect the signed agreement, compare its terms to industry norms, and discuss key provisions with banks, guarantors, or attorneys involved.

Evidence from alternative procedures is often not as strong as a signed confirmation, but done thoroughly, it can bring audit risk down to an acceptable level. Auditors who use blank confirmations tend to rely on these alternatives more often because response rates are lower.

When the Numbers Don’t Match

A confirmation that comes back with a different figure than the books show does not automatically mean something is wrong. Many discrepancies turn out to be timing differences. A payment mailed on the last day of the period, for example, might be recorded on the company’s ledger but not yet posted at the bank. Clerical errors in preparing the request itself can also cause mismatches.

The auditor’s job is to decide, for each exception, whether it is a harmless timing issue or a real misstatement.² A genuine misstatement can signal a breakdown in the accounting system or internal controls. It can also point to fraud. Exceptions get evaluated individually and then looked at together, because a pattern of small discrepancies sometimes reveals a systemic issue that no single one would expose.

Once the auditor identifies an actual misstatement, standard practice calls for revising the original risk assessment and expanding testing. If the initial assessment assumed strong controls and reliable records, a confirmed misstatement undermines that assumption and forces the auditor to dig deeper across related accounts.³

What Confirmations Cost

Financial institutions typically charge a processing fee for each audit confirmation request. Fees vary by bank and by the complexity of the request, but most fall in the range of roughly $25 to $75 per confirmation. Electronic platforms like Confirmation.com operate on a pay-per-request basis with no subscription or setup costs. For audits involving dozens of bank and vendor confirmations, the fees add up quickly and are generally passed through to the audit client as part of the engagement’s out-of-pocket expenses.

1
Public Company Accounting Oversight Board. Comparison of New Proposed Standard AS 2310 with ISA 505 and AU-C Section 505
2
Public Company Accounting Oversight Board. AU Section 330 – The Confirmation Process
3
Public Company Accounting Oversight Board. AS 2310 – The Auditors Use of Confirmation
4
Federal Reserve Financial Services. Audit Confirmation Request Form
5
AICPA. Standard Form to Confirm Account Balance Information with Financial Institutions
6
Confirmation.com. How It Works