An external confirmation is evidence the auditor obtains directly from a third party, such as a bank confirming balances and facilities or a customer confirming what it owes. ISA (UK) 505 requires the auditor to control the whole process, from choosing who to ask to receiving the reply, so the company cannot intercept it. If a confirmation is not returned the auditor must use alternative procedures, and if those cannot give enough evidence the audit opinion may be modified.
Tax investigation insurance from £108.75 a year (£9.06 a month).Pays up to £100,000 of your accountant's fees if HMRC opens an enquiry. No excess. Buy online in a few minutes.
Why do auditors ask third parties to confirm balances?
ISA (UK) 505 paragraph 2 repeats the general rules in ISA (UK) 500: evidence from independent sources outside the company is more reliable, evidence the auditor obtains directly is more reliable than evidence obtained indirectly, and documentary evidence is more reliable than oral. A confirmation sent and received by the auditor meets all three.
ISA (UK) 330 paragraph 19 requires the auditor to consider whether external confirmation procedures should be performed as substantive procedures. Paragraph A50 lists typical uses: bank balances and banking relationships, trade receivables and their terms, stock held by third parties, title deeds held by lawyers or lenders, investments held in safe custody, amounts due to lenders including covenants, and trade payables. Confirmations can also be used to confirm that something does not exist, such as a side agreement affecting revenue cut off.
Paragraph A51 notes a limit that directors often miss: a customer confirming a balance is good evidence that the debt exists, but much weaker evidence that the customer will pay it. Recoverability is tested in other ways, such as reviewing cash received after the year end and the aged debtors listing.
How does the auditor run the process?
ISA (UK) 505 paragraph 7 requires the auditor to maintain control over confirmation requests, including:
- deciding what information to confirm or request;
- choosing the confirming party;
- designing the request so it gives evidence on the relevant assertions, is properly addressed and tells the third party to reply directly to the auditor;
- sending the requests, and follow up requests where needed.
The company’s role is limited. It provides contact details and, usually, signs an authority for the third party to disclose information. Paragraph A4 notes that confirming parties may only reply if the request carries management’s authorisation. Paragraph A6 says the auditor may test the validity of addresses before sending, so a director who supplies a personal email address for a “customer” should expect questions.
The revised standard, effective for periods commencing on or after 15 December 2024, defines an external confirmation to include the auditor directly accessing information held by third parties through web portals, software interfaces or other digital means. Paragraph A6-1 warns that such methods may support accuracy without giving evidence on completeness.
Run an accountancy or bookkeeping practice? Solar Protect runs fee protection schemes for practices, so the cost of dealing with an HMRC enquiry into a client is covered rather than written off.
What are positive and negative confirmations?
A positive confirmation asks the third party to reply in every case, either agreeing to the information or supplying it. Paragraph A5 notes the risk that a recipient simply signs without checking, which the auditor can reduce by sending a “blank” request asking the customer to state the balance itself, at the cost of a lower response rate.
A negative confirmation asks for a reply only if the recipient disagrees. The UK has gone further than the international standard here: paragraph 6(c) of ISA (UK) 505 states that the use of negative confirmations is prohibited in an audit conducted in accordance with ISAs (UK).
How do bank confirmations work in the UK?
The FRC withdrew Practice Note 16, Bank reports for audit purposes, when revised ISA (UK) 330 took effect for periods commencing on or after 15 December 2017, folding the guidance into the standards. ICAEW explains that the decision whether to obtain a bank confirmation is now a matter of professional judgement based on risk, so a bank letter is not automatic for every audit, though it remains common.
ISA (UK) 330 paragraph A52 adds a UK point: depending on risk, the auditor considers whether to ask the bank about trade finance and guarantees and other third party securities, as well as balances and facilities. That is how auditors find undisclosed loans, charges and guarantees that never appear in the ledger. ICAEW’s practical guidance has long told auditors that the client’s authority to disclose must be signed in line with the bank mandate, and to send requests at least a month before the year end. If the company’s bank reconciliations are up to date, differences between the bank’s reply and the books are quick to clear.
What happens if a confirmation is not returned?
Paragraph 12 requires the auditor, for each non response, to perform alternative audit procedures to obtain relevant and reliable evidence. Paragraph A18 gives examples:
| Balance | Alternative procedures |
|---|---|
| Trade receivables | Examining specific cash received after the year end, shipping documents and sales near the year end |
| Trade payables | Examining payments after the year end, correspondence from suppliers and goods received notes |
| Bank balances | Reminders to the bank, watching company staff log in to online banking or third party bank statements, visiting the bank with management for an in person confirmation, reviewing minutes |
Paragraph A19 warns that non responses may point to a previously unidentified risk, and that fewer or more responses than expected may indicate a fraud risk factor. There is an exception to the alternative procedures route. Under paragraph 13, if the auditor decided a positive reply was necessary, for example because the evidence exists only outside the company or because of a risk of collusion, alternative procedures will not do and the auditor must consider the effect on the opinion under ISA (UK) 705. Paragraph A15 adds that an oral reply on its own is not an external confirmation; the auditor may ask for a written reply and, if none comes, seeks other evidence.
What if the reply disagrees with the books?
A difference is called an exception. Paragraph 14 requires the auditor to investigate exceptions to see whether they indicate misstatements, and paragraph 14-1 requires it to consider whether an exception suggests fraud or a control deficiency. Paragraph A22 recognises that many exceptions are just timing or clerical differences.
Illustration only. A customer confirms it owes £18,000; the sales ledger shows £25,000. The finance team shows that a £7,000 invoice was raised on 30 June, the year end, for goods that left the warehouse on 2 July. That is a cut off error rather than a timing difference, so the auditor proposes an adjustment and may extend its cut off testing. Had the goods left on 29 June and the customer simply not booked the invoice yet, the difference would have been reconciled and no adjustment needed.
Can directors stop the auditor writing to a customer?
They can ask, but there are consequences. Paragraph 8 requires the auditor to ask why, seek evidence that the reasons are valid and reasonable, consider the effect on its risk assessment including fraud risk, and perform alternative procedures. Paragraph A8 says a common reason is a legal dispute or negotiation with that customer. If the auditor concludes the refusal is unreasonable, or cannot get enough evidence another way, paragraph 9 requires it to communicate with those charged with governance and consider the effect on the opinion. The forms of modified opinion are covered in audit opinions.
What are the common mistakes?
- Sending the bank authority late or signed by the wrong people, so the reply arrives after the planned sign off date.
- Forwarding a reply the company received by mistake. Paragraph A14 allows the auditor to ask the third party to respond directly instead, because a reply received indirectly is less reliable.
- Calling customers to “warn” them about a request, which undermines the evidence.
- Assuming a confirmed debt is collectable.
- Forgetting stock held at a third party warehouse, which may also be confirmed; see stocktake attendance.
Solar Protect provides tax investigation insurance for businesses and fee protection schemes for accountancy practices. Read how our cover works or get a quote.
Related Accountapedia entries
- What counts as sufficient appropriate audit evidence
- Management representation letters
- First year audits and opening balances
- Auditing related parties: ISA (UK) 550
- How a statutory audit works
Sources
- Financial Reporting Council: ISA UK 505 Revised October 2023 Updated October 2025
- Financial Reporting Council: ISA UK 330 Revised July 2017 Updated September 2025
- Financial Reporting Council: Revisions to international standards on auditing uk
- ICAEW: Do i still need a bank letter
- ICAEW: Bank reports for audit purposes points to remember
Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.