Warning

The content on this page has been converted from PDF to HTML format using an artificial intelligence (AI) tool as part of our ongoing efforts to improve accessibility and usability of our publications. Note:

  • No human verification has been conducted of the converted content.
  • While we strive for accuracy errors or omissions may exist.
  • This content is provided for informational purposes only and should not be relied upon as a definitive or authoritative source.
  • For the official and verified version of the publication, refer to the original PDF document.

If you identify any inaccuracies or have concerns about the content, please contact us at [email protected].

Proposed International Standard on Auditing (UK) 505 (Revised) - External Confirmations

The FRC's mission is to promote transparency and integrity in business. The FRC sets the UK Corporate Governance and Stewardship Codes and UK standards for accounting and actuarial work; monitors and takes action to promote the quality of corporate reporting; and operates independent enforcement arrangements for accountants and actuaries. As the Competent Authority for audit in the UK the FRC sets auditing and ethical standards and monitors and enforces audit quality.

The FRC does not accept any liability to any party for any loss, damage or costs howsoever arising, whether directly or indirectly, whether in contract, tort or otherwise from any action or decision taken (or not taken) as a result of any person relying on or otherwise using this document or arising from any omission from it.

© The Financial Reporting Council Limited 2023 The Financial Reporting Council Limited is a company limited by guarantee. Registered in England number 2486368. Registered Office: 8th Floor, 125 London Wall, London EC2Y 5AS

Contents

International Standard on Auditing (UK) (ISA (UK)) 505 (Revised), External Confirmations, should be read in conjunction with ISA (UK) 200 (Revised June 2016), Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with International Standards on Auditing (UK).

Introduction

Scope of this ISA (UK)

1This International Standard on Auditing (UK) (ISA (UK)) deals with the auditor's use of external confirmation procedures to obtain audit evidence in accordance with the requirements of ISA (UK) 330 (Revised July 2017) 1 and ISA (UK) 500. 2 It does not address inquiries regarding litigation and claims, which are dealt with in ISA (UK) 501. 3

External Confirmation Procedures to Obtain Audit Evidence

2ISA (UK) 500 indicates that the reliability of audit evidence is influenced by its source and by its nature, and is dependent on the individual circumstances under which it is obtained. 4 That ISA (UK) also includes the following generalizations applicable to audit evidence: 5

  • Audit evidence is more reliable when it is obtained from independent sources outside the entity.
  • Audit evidence obtained directly by the auditor is more reliable than audit evidence obtained indirectly or by inference.
  • Audit evidence is more reliable when it exists in documentary form, whether paper, electronic or other medium.

Accordingly, depending on the circumstances of the audit, audit evidence in the form of external confirmations received directly by the auditor from confirming parties may be more reliable than evidence generated internally by the entity. This ISA (UK) is intended to assist the auditor in designing and performing external confirmation procedures to obtain relevant and reliable audit evidence.

3Other ISAs (UK) recognize the importance of external confirmations as audit evidence, for example:

  • ISA (UK) 330 (Revised July 2017) discusses the auditor's responsibility to design and implement overall responses to address the assessed risks of material misstatement at the financial statement level, and to design and perform further audit procedures whose nature, timing and extent are based on, and are responsive to, the assessed risks of material misstatement at the assertion level. 6 In addition, ISA (UK) 330 (Revised July 2017) requires that, irrespective of the assessed risks of material misstatement, the auditor designs and performs substantive procedures for each material class of transactions, account balance, and disclosure. The auditor is also required to consider whether external confirmation procedures are to be performed as substantive audit procedures. 7
  • ISA (UK) 330 (Revised July 2017) requires that the auditor obtain more persuasive audit evidence the higher the auditor's assessment of risk. 8 To do this, the auditor may increase the quantity of the evidence or obtain evidence that is more relevant or reliable, or both. For example, the auditor may place more emphasis on obtaining evidence directly from third parties or obtaining corroborating evidence from a number of independent sources. ISA (UK) 330 (Revised July 2017) also indicates that external confirmation procedures may assist the auditor in obtaining audit evidence with the high level of reliability that the auditor requires to respond to significant risks of material misstatement, whether due to fraud or error. 9
  • ISA (UK) 240 (Revised May 2021) indicates that the auditor may design confirmation requests to obtain additional corroborative information as a response to address the assessed risks of material misstatement due to fraud at the assertion level. 10
  • ISA (UK) 500 indicates that corroborating information obtained from a source independent of the entity, such as external confirmations, may increase the assurance the auditor obtains from evidence existing within the accounting records or from representations made by management. 11

Effective Date

4This ISA (UK) is effective for audits of financial statements for periods commencing on or after 15 December 2024.

Objective

5The objective of the auditor, when using external confirmation procedures, is to design and perform such procedures to obtain relevant and reliable audit evidence.

Definitions

6For purposes of the ISAs (UK), the following terms have the meanings attributed below:

  1. External confirmation – Audit evidence obtained as a direct written response to the auditor from a third party (the confirming party), in paper form, or by electronic or other medium. Electronic medium could include auditors directly accessing information held by third parties through web portals, software interfaces or other digital means.
  2. Positive confirmation request – A request that the confirming party respond directly to the auditor indicating whether the confirming party agrees or disagrees with the information in the request, or providing the requested information.
  3. Negative confirmation request – A request that the confirming party respond directly to the auditor only if the confirming party disagrees with the information provided in the request.

The use of negative confirmations is prohibited in an audit conducted in accordance with ISAs (UK). Accordingly, the requirements and related application material in this ISA (UK) relating to negative confirmations are not applicable. 12

  1. Non-response – A failure of the confirming party to respond, or fully respond, to a positive confirmation request, or a confirmation request returned undelivered.
  2. Exception – A response that indicates a difference between information requested to be confirmed, or contained in the entity’s records, and information provided by the confirming party.

Requirements

External Confirmation Procedures

7When using external confirmation procedures, the auditor shall maintain control over external confirmation requests, including:

  1. Determining the information to be confirmed or requested; (Ref: Para. A1)
  2. Selecting the appropriate confirming party; (Ref: Para. A2)
  3. Designing the confirmation requests, including determining that requests are appropriately designed to provide evidence relevant to the assertions identified in accordance with ISA (UK) 330 13, are properly addressed and contain return information for responses to be sent directly to the auditor; and (Ref: Para. A3–A6-1)
  4. Sending the requests, including follow-up requests when applicable, to the confirming party. (Ref: Para. A7)

Management's Refusal to Allow the Auditor to Send a Confirmation Request

8If management refuses to allow the auditor to send a confirmation request, the auditor shall:

  1. Inquire as to management's reasons for the refusal, and seek audit evidence as to their validity and reasonableness; (Ref: Para. A8)
  2. Evaluate the implications of management's refusal on the auditor's assessment of the relevant risks of material misstatement, including the risk of fraud, and on the nature, timing and extent of other audit procedures; and (Ref: Para. A9)
  3. Perform alternative audit procedures designed to obtain relevant and reliable audit evidence. (Ref: Para. A10)

9If the auditor concludes that management's refusal to allow the auditor to send a confirmation request is unreasonable, or the auditor is unable to obtain relevant and reliable audit evidence from alternative audit procedures, the auditor shall communicate with those charged with governance in accordance with ISA (UK) 260 (Revised November 2019). 14 The auditor also shall determine the implications for the audit and the auditor's opinion in accordance with ISA (UK) 705 (Revised June 2016). 15

Results of the External Confirmation Procedures

Reliability of Responses to Confirmation Requests

10If the auditor identifies factors that give rise to doubts about the reliability of the response to a confirmation request, the auditor shall obtain further audit evidence to resolve those doubts. (Ref: Para. A11–A16)

11If the auditor determines that a response to a confirmation request is not reliable, the auditor shall evaluate the implications on the assessment of the relevant risks of material misstatement, including the risk of fraud, and on the related nature, timing and extent of other audit procedures. (Ref: Para. A17)

Non-Responses

12In the case of each non-response, the auditor shall perform alternative audit procedures to obtain relevant and reliable audit evidence. (Ref: Para A18–A19)

When a Response to a Positive Confirmation Request Is Necessary to Obtain Sufficient Appropriate Audit Evidence

13If the auditor has determined that a response to a positive confirmation request is necessary to obtain sufficient appropriate audit evidence, alternative audit procedures will not provide the audit evidence the auditor requires. If the auditor does not obtain such confirmation, the auditor shall determine the implications for the audit and the auditor's opinion in accordance with ISA (UK) 705 (Revised June 2016). (Ref: Para A20)

Exceptions

14The auditor shall investigate exceptions to determine whether or not they are indicative of misstatements. (Ref: Para. A21–A22)

14-1When investigating exceptions in accordance with paragraph 14, the auditor shall consider the following factors when determining the timing and extent of any additional procedures:

  1. Whether the exception is indicative of an increased risk of fraud. 16
  2. Whether the exception is indicative of a deficiency in the entity's system of internal control. 17
  3. How any additional procedures will allow the auditor to obtain sufficient appropriate audit evidence. 18

Negative Confirmations

15Negative confirmations provide less persuasive audit evidence than positive confirmations. Accordingly, the auditor shall not use negative confirmation requests as the sole substantive audit procedure to address an assessed risk of material misstatement at the assertion level unless all of the following are present: (Ref: Para. A23)

  1. The auditor has assessed the risk of material misstatement as low and has obtained sufficient appropriate audit evidence regarding the operating effectiveness of controls relevant to the assertion;
  2. The population of items subject to negative confirmation procedures comprises a large number of small, homogeneous, account balances, transactions or conditions;
  3. A very low exception rate is expected; and
  4. The auditor is not aware of circumstances or conditions that would cause recipients of negative confirmation requests to disregard such requests.

Evaluating the Evidence Obtained

16The auditor shall evaluate whether the results of the external confirmation procedures provide relevant and reliable audit evidence, or whether further audit evidence is necessary. (Ref: Para A24–A25)

Application and Other Explanatory Material

External Confirmation Procedures

Determining the Information to Be Confirmed or Requested (Ref: Para. 7(a))

A1External confirmation procedures frequently are performed to confirm or request information regarding account balances and their elements. They may also be used to confirm terms of agreements, contracts, or transactions between an entity and other parties, or to confirm the absence of certain conditions, such as a "side agreement."

Selecting the Appropriate Confirming Party (Ref: Para. 7(b))

A2Responses to confirmation requests provide more relevant and reliable audit evidence when confirmation requests are sent to a confirming party the auditor believes is knowledgeable about the information to be confirmed. For example, a financial institution official who is knowledgeable about the transactions or arrangements for which confirmation is requested may be the most appropriate person at the financial institution from whom to request confirmation.

Designing Confirmation Requests (Ref: Para. 7(c))

A3The design of a confirmation request may directly affect the confirmation response rate, and the reliability and the nature of the audit evidence obtained from responses.

A4Factors to consider when designing confirmation requests include:

  • The assertions being addressed.
  • Specific identified risks of material misstatement, including fraud risks.
  • The layout and presentation of the confirmation request.
  • Prior experience on the audit or similar engagements.
  • The method of communication (for example, in paper form, or by electronic or other medium).
  • Management's authorization or encouragement to the confirming parties to respond to the auditor. Confirming parties may only be willing to respond to a confirmation request containing management's authorization.
  • The ability of the intended confirming party to confirm or provide the requested information (for example, individual invoice amount versus total balance).

A5A positive external confirmation request asks the confirming party to reply to the auditor in all cases, either by indicating the confirming party's agreement with the given information, or by asking the confirming party to provide information. A response to a positive confirmation request ordinarily is expected to provide reliable audit evidence. There is a risk, however, that a confirming party may reply to the confirmation request without verifying that the information is correct. The auditor may reduce this risk by using positive confirmation requests that do not state the amount (or other information) on the confirmation request, and ask the confirming party to fill in the amount or furnish other information. On the other hand, use of this type of "blank" confirmation request may result in lower response rates because additional effort is required of the confirming parties.

A6Determining that requests are properly addressed includes testing the validity of some or all of the addresses on confirmation requests before they are sent out.

A6-1When making use of external confirmations to obtain audit evidence, particularly when using electronic means such as directly accessing information held by third parties through web portals, software interfaces or other digital means, auditors should ensure that evidence is obtained for all relevant assertions identified in accordance with ISA (UK) 330 19 as some means of obtaining confirmations may not provide evidence over all relevant assertions. For example, software interfaces may provide evidence over accuracy or valuation, but may not over completeness and as such the auditor may need to design additional procedures to ensure they have collected evidence to support all relevant assertions.

Follow-Up on Confirmation Requests (Ref: Para. 7(d))

A7The auditor may send an additional confirmation request when a reply to a previous request has not been received within a reasonable time. For example, the auditor may, having re-verified the accuracy of the original address, send an additional or follow-up request.

Management's Refusal to Allow the Auditor to Send a Confirmation Request

Reasonableness of Management's Refusal (Ref: Para. 8(a))

A8A refusal by management to allow the auditor to send a confirmation request is a limitation on the audit evidence the auditor may wish to obtain. The auditor is therefore required to inquire as to the reasons for the limitation. A common reason advanced is the existence of a legal dispute or ongoing negotiation with the intended confirming party, the resolution of which may be affected by an untimely confirmation request. The auditor is required to seek audit evidence as to the validity and reasonableness of the reasons because of the risk that management may be attempting to deny the auditor access to audit evidence that may reveal fraud or error.

Implications for the Assessment of Risks of Material Misstatement (Ref: Para. 8(b))

A9The auditor may conclude from the evaluation in paragraph 8(b) that it would be appropriate to revise the assessment of the risks of material misstatement at the assertion level and modify planned audit procedures in accordance with ISA (UK) 315 (Revised July 2020). 20 For example, if management's request to not confirm is unreasonable, this may indicate a fraud risk factor that requires evaluation in accordance with ISA (UK) 240 (Revised May 2021). 21

Alternative Audit Procedures (Ref: Para. 8(c))

A10The alternative audit procedures performed may be similar to those appropriate for a non-response as set out in paragraphs A18–A19 of this ISA (UK). Such procedures also would take account of the results of the auditor's evaluation in paragraph 8(b) of this ISA (UK).

Results of the External Confirmation Procedures

Reliability of Responses to Confirmation Requests (Ref: Para. 10)

A11ISA (UK) 500 indicates that even when audit evidence is obtained from sources external to the entity, circumstances may exist that affect its reliability. 22 All responses carry some risk of interception, alteration or fraud. Such risk exists regardless of whether a response is obtained in paper form, or by electronic or other medium. Factors that may indicate doubts about the reliability of a response include that it:

  • Was received by the auditor indirectly; or
  • Appeared not to come from the originally intended confirming party.

A12Responses received electronically, for example by facsimile or electronic mail, involve risks as to reliability because proof of origin and authority of the respondent may be difficult to establish, and alterations may be difficult to detect. A process used by the auditor and the respondent that creates a secure environment for responses received electronically may mitigate these risks. If the auditor is satisfied that such a process is secure and properly controlled, the reliability of the related responses is enhanced. An electronic confirmation process might incorporate various techniques for validating the identity of a sender of information in electronic form, for example, through the use of encryption, electronic digital signatures, and procedures to verify web site authenticity.

A13If a confirming party uses a third party to coordinate and provide responses to confirmation requests, the auditor may perform procedures to address the risks that:

  1. The response may not be from the proper source;
  2. A respondent may not be authorized to respond; and
  3. The integrity of the transmission has been compromised.

A14The auditor is required by ISA (UK) 500 to determine whether to modify or add procedures to resolve doubts over the reliability of information to be used as audit evidence. 23 The auditor may choose to verify the source and contents of a response to a confirmation request by contacting the confirming party. For example, when a confirming party responds by electronic mail, the auditor may telephone the confirming party to determine whether the confirming party did, in fact, send the response. When a response has been returned to the auditor indirectly (for example, because the confirming party incorrectly addressed it to the entity rather than to the auditor), the auditor may request the confirming party to respond in writing directly to the auditor.

A15On its own, an oral response to a confirmation request does not meet the definition of an external confirmation because it is not a direct written response to the auditor. However, upon obtaining an oral response to a confirmation request, the auditor may, depending on the circumstances, request the confirming party to respond in writing directly to the auditor. If no such response is received, in accordance with paragraph 12, the auditor seeks other audit evidence to support the information in the oral response.

A16A response to a confirmation request may contain restrictive language regarding its use. Such restrictions do not necessarily invalidate the reliability of the response as audit evidence.

Unreliable Responses (Ref: Para. 11)

A17When the auditor concludes that a response is unreliable, the auditor may need to revise the assessment of the risks of material misstatement at the assertion level and modify planned audit procedures accordingly, in accordance with ISA (UK) 315 (Revised July 2020). 24 For example, an unreliable response may indicate a fraud risk factor that requires evaluation in accordance with ISA (UK) 240 (Revised May 2021). 25

Non-Responses (Ref: Para. 12)

A18Examples of alternative audit procedures the auditor may perform include:

  • For accounts receivable balances – examining specific subsequent cash receipts, shipping documentation, and sales near the period-end.
  • For accounts payable balances – examining subsequent cash disbursements or correspondence from third parties, and other records, such as goods received notes.
  • For bank balances – periodic reminders to the confirming party whilst also reviewing online banking/third party bank statements/banking agreements, physically visiting the bank with management to obtain an in-person confirmation and examining minutes for references to unexpected balances or payments.

A19The nature and extent of alternative audit procedures are affected by the account and assertion in question. A non-response to a confirmation request may indicate a previously unidentified risk of material misstatement. In such situations, the auditor may need to revise the assessed risk of material misstatement at the assertion level, and modify planned audit procedures, in accordance with ISA (UK) 315 (Revised July 2020). 26 For example, fewer responses to confirmation requests than anticipated, or a greater number of responses than anticipated, may indicate a previously unidentified fraud risk factor that requires evaluation in accordance with ISA (UK) 240 (Revised May 2021). 27

When a Response to a Positive Confirmation Request Is Necessary to Obtain Sufficient Appropriate Audit Evidence (Ref. Para. 13)

A20In certain circumstances, the auditor may identify an assessed risk of material misstatement at the assertion level for which a response to a positive confirmation request is necessary to obtain sufficient appropriate audit evidence. Such circumstances may include where:

  • The information available to corroborate management's assertion(s) is only available outside the entity.
  • Specific fraud risk factors, such as the risk of management override of controls, or the risk of collusion which can involve employee(s) and/or management, prevent the auditor from relying on evidence from the entity.

Exceptions (Ref: Para. 14)

A21Exceptions noted in responses to confirmation requests may indicate misstatements or potential misstatements in the financial statements. When a misstatement is identified, the auditor is required by ISA (UK) 240 (Revised May 2021) to evaluate whether such misstatement is indicative of fraud. 28 Exceptions may provide a guide to the quality of responses from similar confirming parties or for similar accounts. Exceptions also may indicate a deficiency, or deficiencies, in the entity's internal control over financial reporting.

A22Some exceptions do not represent misstatements. For example, the auditor may conclude that differences in responses to confirmation requests are due to timing, measurement, or clerical errors in the external confirmation procedures.

Negative Confirmations (Ref: Para. 15)

A23The failure to receive a response to a negative confirmation request does not explicitly indicate receipt by the intended confirming party of the confirmation request or verification of the accuracy of the information contained in the request. Accordingly, a failure of a confirming party to respond to a negative confirmation request provides significantly less persuasive audit evidence than does a response to a positive confirmation request. Confirming parties also may be more likely to respond indicating their disagreement with a confirmation request when the information in the request is not in their favor, and less likely to respond otherwise. For example, holders of bank deposit accounts may be more likely to respond if they believe that the balance in their account is understated in the confirmation request, but may be less likely to respond when they believe the balance is overstated. Therefore, sending negative confirmation requests to holders of bank deposit accounts may be a useful procedure in considering whether such balances may be understated, but is unlikely to be effective if the auditor is seeking evidence regarding overstatement.

Evaluating the Evidence Obtained (Ref: Para. 16)

A24When evaluating the results of individual external confirmation requests, the auditor may categorize such results as follows:

  1. A response by the appropriate confirming party indicating agreement with the information provided in the confirmation request, or providing requested information without exception;
  2. A response deemed unreliable;
  3. A non-response; or
  4. A response indicating an exception.

A25The auditor's evaluation, when taken into account with other audit procedures the auditor may have performed, may assist the auditor in concluding whether sufficient appropriate audit evidence has been obtained or whether further audit evidence is necessary, as required by ISA (UK) 330 (Revised July 2017). 29

Financial Reporting Council 8th Floor 125 London Wall London EC2Y 5AS

+44 (0)20 7492 2300 www.frc.org.uk

Footnotes

  1. ISA (UK) 330 (Revised July 2017), The Auditor's Responses to Assessed Risks. ↩

  2. ISA (UK) 500, Audit Evidence. ↩

  3. ISA (UK) 501, Audit Evidence—Specific Considerations for Selected Items. ↩

  4. ISA (UK) 500, paragraph A9. ↩

  5. ISA (UK) 500, paragraph A35. ↩

  6. ISA (UK) 330 (Revised July 2017), paragraphs 5–6. ↩

  7. ISA (UK) 330 (Revised July 2017), paragraphs 18–19. ↩

  8. ISA (UK) 330 (Revised July 2017), paragraph 7(b). ↩

  9. ISA (UK) 330 (Revised July 2017), paragraph A53. ↩

  10. ISA (UK) 240 (Revised May 2021), The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements, paragraph A38. ↩

  11. ISA (UK) 500, paragraph A12–A13. ↩

  12. The non-applicable requirements are those set out in paragraphs 6(c), 15 and A23. ↩

  13. ISA (UK) 330 (Revised July 2017) The Auditor's Responses to Assessed Risks. ↩

  14. ISA (UK) 260 (Revised November 2019), Communication with Those Charged with Governance, paragraph 16. ↩

  15. ISA (UK) 705 (Revised June 2016), Modifications to the Opinion in the Independent Auditor's Report. ↩

  16. ISA (UK) 240 (Revised May 2021) The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements. ↩

  17. ISA (UK) 315 (Revised 2020) Identifying and Assessing the Risks of Material Misstatement, paragraph 27. ↩

  18. ISA (UK) 500 Audit Evidence, paragraph 6. ↩

  19. ISA (UK) 330 (Revised July 2017) The Auditor's Responses to Assessed Risks. ↩

  20. ISA (UK) 315 (Revised July 2020), Identifying and Assessing the Risks of Material Misstatement, paragraph 37. ↩

  21. ISA (UK) 240 (Revised May 2021), paragraph 25. ↩

  22. ISA (UK) 500, paragraph A35. ↩

  23. ISA (UK) 500, paragraph 11. ↩

  24. ISA (UK) 315 (Revised July 2020), paragraph 37. ↩

  25. ISA (UK) 240 (Revised May 2021), paragraph 25. ↩

  26. ISA (UK) 315 (Revised July 2020), paragraph 37. ↩

  27. ISA (UK) 240 (Revised May 2021), paragraph 25. ↩

  28. ISA (UK) 240 (Revised May 2021), paragraph 36. ↩

  29. ISA (UK) 330 (Revised July 2017), paragraphs 26–27. ↩

File

Name Proposed International Standard on Auditing (UK) 505 (Revised) - External Confirmations
Publication date 04 October 2023
Format PDF, 1.7 MB
Download original
Back to top