SA 505:-External Confirmations(Effective 01/04/2010)

Audit evidence obtained as a direct written response to the auditor from a third party (the confirming party), in paper form, or by electronic or other medium.

• Positive confirmation request – A request that the confirming party respond directly to the auditor indicating whether the confirming party agrees or disagrees with the information in the request, or providing the requested information.

Negative confirmation request – A request that the confirming party respond directly to the auditor only if the confirming party disagrees with the information provided in the request.

When using external confirmation procedures, the auditor shall maintain control over external confirmation requests, including:

1. Determining the information to be confirmed or requested; 
2. Selecting the appropriate confirming party; 
3. Designing the confirmation requests, including determining that requests are properly addressed and contain return information for responses to be sent directly to the auditor; and 
4. Sending the requests, including follow-up requests when applicable, to the confirming party.

1. The assertions being addressed.
2. Specific identified risks of material misstatement, including fraud risks.
3. The layout and presentation of the confirmation request.
4. Prior experience on the audit or similar engagements.
5. The method of communication (for example, in paper form, or by electronic or other medium).
6. Management’s authorisation or encouragement to the confirming parties to respond to the auditor. Confirming parties may only be willing to respond to a confirmation request containing management’s authorisation.
7. The ability of the intended confirming party to confirm or provide the requested information (for example, individual invoice amount versus total balance).

1. Doubt about reliability of responses:- If the auditor identifies factors that give rise to doubts about the reliability of the response to a confirmation request, the auditor shall obtain further audit evidence to resolve those doubts. 
2. Confirms that responses are not reliable:- If the auditor determines that a response to a confirmation request is not reliable, the auditor shall evaluate the implications on the assessment of the relevant risks of material misstatement, including the risk of fraud, and on the related nature, timing and extent of other audit procedures. 
3. No Response:- In the case of each non-response, the auditor shall perform alternative audit procedures to obtain relevant and reliable audit evidence. 
4. Exceptions are identified

• A response that indicates a difference between information requested to be confirmed, or contained in the entity’s records, and information provided by the confirming party.
• The auditor shall investigate exceptions to determine whether or not they are indicative of misstatements
• Some exceptions do not represent misstatements. For example, the auditor may conclude that differences in responses to confirmation requests are due to timing, measurement, or clerical errors in the external confirmation procedures

1. If management refuses to allow the auditor to send a confirmation request, the auditor shall:

• Inquire as to management’s reasons for the refusal, and seek audit evidence as to their validity and reasonableness; 
• Evaluate the implications of management’s refusal on the auditor’s assessment of the relevant risks of material misstatement, including the risk of fraud, and on the nature, timing and extent of other audit procedures; and 
• Perform alternative audit procedures designed to obtain relevant and reliable audit evidence. 

If the auditor concludes that management’s refusal to allow the auditor to send a confirmation request is unreasonable, or the auditor is unable to obtain relevant and reliable audit evidence from alternative audit procedures, the auditor shall communicate with those charged with governance in accordance with SA 260. The auditor also shall determine the implications for the audit and the auditor’s opinion in accordance with SA 705.

Negative confirmations provide less persuasive audit evidence than positive confirmations. Accordingly, the auditor shall not use negative confirmation requests as the sole substantive audit procedure to address an assessed risk of material misstatement at the assertion level unless all of the following are present: 

• The auditor has assessed the risk of material misstatement as low and has obtained sufficient appropriate audit evidence regarding the operating effectiveness of controls relevant to the assertion;
• The population of items subject to negative confirmation procedures comprises a large number of small, homogeneous, account balances, transactions or conditions;
• A very low exception rate is expected; and
• The auditor is not aware of circumstances or conditions that would cause recipients of negative confirmation requests to disregard such requests.

To get detailed understanding of the concept you can consider purchasing our Audit classes from here – https://lecturepedia.in/product/ca-final-audit-fastrack-classes-for-nov-2023-onward-exams-by-ca-balakrishna-kovuru/