Confirmations and Audit Risk

During the confirmation process, the auditor requests, directly from a third party, information on items relating to particular assertions in the financial statements. The auditor selects items to be confirmed, designs the confirmation form, and sends the confirmations to third parties. Included in the sequence is the auditor's receipt of the confirmation response and subsequent evaluation of the information provided.

SAS 47 Audit Risk and Materiality in Conducting an Audit, presents an audit risk model used in planning audit work relating to a particular assertion. As the auditor's combined assessment of inherent and control risk increases, the planned level of detection risk decreases and the need for more reliable evidence increases. Confirmations often provide reliable audit evidence because the auditor receives them directly from third parties. Confirmations may be used alone or, if additional assurance is required, can be combined with other substantive procedures. As the assessed level of inherent and control risk decreases, the need for assurance from substantive tests drops. The auditor may then choose to change from more effective but costly procedures, such as confirmations, to less effective, less costly procedures.

Developing and Sending Confirmations

The confirmation process begins when the auditor develops the confirmation form and sends it to a third party. When developing the confirmation, the auditor considers which specific assertions the evidence from the form will address. Evidence obtained through the confirmation process may support one or more of the five assertions management makes about accounts and classes of transactions in the financial statements. These assertions are existence or occurrence, rights and obligations, completeness, valuation or allocation, and presentation and disclosure. Confirmations may provide better evidence about some assertions than others. For example, confirmations of accounts receivable typically yield reliable evidence on the existence assertion. Experience with confirmations, the type of information being confirmed, positive versus negative forms, and the respondents are also considered.

The auditor may have experience with confirmations, perhaps with the specific client or with clients in the same industry. Knowledge gained from that experience may include information on response rates, errors reported previously, or inaccurate responses. If response rates were poor or if inaccurate responses are common, the auditor may consider obtaining evidence by a method other than confirmations. If the respondents previously reported errors, the auditor may choose to increase the number of confirmations sent in hopes of locating even more misstatements.

To determine the type of information to be confirmed, the auditor should understand the substance of transactions the client has with third parties. Normally, the amount of the transactions is confirmed, but the auditor may also wish to confirm the terms of the agreement, especially for unusual agreements or for oral modifications to agreements. The types of information respondents will be able to confirm should also be considered. For example, some respondents can confirm account balances, but others can more readily confirm single transactions. Also, some respondents may not be able to confirm a balance, but can confirm whether payments are current, the periodic payment, and the terms of the agreement.

The auditor also considers whether to use positive or negative confirmations. Positive forms typically request the recipient to indicate whether the information provided is correct. Blank forms (a type of positive confirmation) request that the recipient furnishes certain data. Negative confirmations request a response only if the information on the form is inaccurate.

Positive confirmations are usually a reliable source of evidence. However, evidence is obtained only if a response is received; nonresponses to positive confirmations yield no evidence. To try to elicit a response, the auditor should send a second or even a third request.

Another problem with positive confirmations is that respondents may simply sign the form and return it without verifying the accuracy of the information. To address this problem, the auditor should consider using the blank form. Because the blank form requires the respondent to supply the requested information, it may provide better assurance than the positive form. However, the blank form may result in a lower response rate.

Negative confirmations provide less reliable evidence than positive confirmations because nonresponses are assumed to contain accurate information. The auditor does not know if the intended recipient considered the form or even received it. Still, there are times when the auditor may choose to send negative confirmations.

* The negative form may be used if three criteria are met;

* The combined assessment of inherent and control risk in the population is low;

* The population consists of a large number of small balances; and

* There is no reason to believe that the recipient will not consider the confirmation.

Exhibit 1 shows examples of situations in which negative confirmations might be appropriate.

Because negative confirmations yield less reliable evidence, the auditor should consider supplementing that evidence with other substantive procedures. Consider, for example, an accounts receivable population in which there are a few large past-due related party balances and many small current accounts. The auditor might positively confirm the related-party balances and use negative confirmations for the remainder of the population.

When developing the confirmation form, the auditor also considers the intended recipient. The form should be sent to a third party who is knowledgeable about the information being confirmed. If the respondent's competence, motivation, or objectivity is questionable, the auditor should consider whether the evidence obtained is reliable.

Sending The Confirmations

The auditor must maintain control over sending the confirmations and the responses received. The confirmation should be a direct communication between the auditor and the respondent, without interference or interception by the client.

External auditors are not precluded from considering evidence from confirmations sent by internal auditors or from using internal auditors as assistants in the confirmation process. SAS 65, The Auditor's Consideration of the Internal Audit Function in an Audit of Financial Statements, provides guidance regarding external and internal auditors working together.

Most confirmations are sent and returned through the mail, but some recipients may reply by telephone or use a facsimile response. A telephone response should be documented in the workpapers. The practitioner should note the caller's name and position and the time and date of the call, in addition to the information provided. If the information from the call is significant, the auditor should ask the respondent to mail in a written confirmation. After receiving a facsimile response, the auditor should call the respondent to verify the source and accuracy of the information confirmed.

Results

As noted earlier, the recipients of negative confirmations are not asked to respond to the form unless the information provided is inaccurate. Recipients of positive confirmations, including the blank form, are expected to reply. If there is no reply after a second or third request, the auditor performs alternative procedures to gather the needed audit evidence. Then, the results of the confirmation process can be evaluated.

Alternative Procedures

The auditor uses professional judgment in determining appropriate alternative procedures. The choice of procedures depends on the account and assertion being considered. For example, if the confirmations are designed to produce evidence on the completeness assertion for accounts payable, alternative procedures might include the auditor's examining subsequent cash disbursements and vendors' invoices received shortly after year-end. Other examples of alternative procedures are in Exhibit 2.

Evaluating The Results

After performing alternative procedures, the auditor evaluates the evidence provided by both the confirmations and the alternative procedures. The reliability of the evidence, the response rate, and the nature of the exceptions is considered. Exceptions are evaluated quantitatively and qualitatively. For example, assume there are few tax exceptions to confirmations. The qualities (irregularities, fraud, illegal acts) of the exceptions may still cause the auditor concern.

Conversely, there may be many exceptions, but if most or all can be traced to errors occurring while the regular clerk was on vacation, the auditor may still have gained con-siderable assurance (except for the period of the errors) for the assertion.

After considering the confirmations, alternative procedures, and other work related to the assertions, the auditor may believe sufficient, competent evidence has been gathered. If the evidence is unsatisfactory, the auditor performs additional substantive tests that may require sending more confirmations or performing analytical procedures.

Confirmations in Today's Audit Process

SAS 67 increases guidance on the confirmation process. The SAS provides helpful suggestions on developing and sending the confirmation form, performing alternative procedures, and evaluating the results. Perhaps most importantly, SAS 67 ties the confirmation process to the profession's audit risk model and to detection risk specifically. By following the suggestions in SAS 67, the practitioner can use confirmations to perform an efficient and effective audit.