Considering whether EXTERNAL CONFIRMATION procedures are to be performed as Substantive Audit Procedures

Substantive procedure is an audit procedure designed to detect material misstatements at the assertion level. Substantive procedures comprise :

1. Tests of details (of classes of transactions, account balances, and disclosures); and
2. Substantive analytical procedures

While conducting substantive audit procedures, the auditor is required to consider whether EXTERNAL CONFIRMATION procedures are to be performed as part of substantive audit procedures.

ISA 330 paragraph A48 states that EXTERNAL CONFIRMATION procedures frequently are relevant when addressing assertions associated with account balances and their elements, but need not be restricted to these items. For example, the auditor may request external confirmation of the terms of agreements, contracts, or transactions between and entity and other parties. External confirmation procedures also may be performed to obtain audit evidence about the absence of certain conditions. For example, a request may specifically seek confirmation that no”side agreement” exists that may be relevant to an entity’s revenue cutoff assertion. Other situations where external confirmation procedures may provide relevant audit evidence in responding to assessed risks of material misstatement include :

• Bank balances and other information relevant to banking relationships
• Account receivable balances and terms
• Inventories held by third parties at bonded warehouse for processing or on consignment
• Property title deeds held by lawyers or financiers for safe custody or as security
• Investments held for safekeeping by third parties, or purchased from stockbrokers but not delivered at the balance sheet date
• Amounts due to lenders, including relevant terms of repayment and restrictive covenants
• Account payable balances and terms

Although external confirmations may provide relevant audit evidence relating to certain assertions, there are some assertions for which external confirmations provide less relevant audit evidence. For example, external confirmations provide less relevant audit evidence relating to the recoverability of accounts receivable balance, than they do of their existence.

The auditor may determine that external confirmation procedures performed for one purpose provide and opportunity to obtain audit evidence about other matters. For example, confirmation requests for bank balances often include requests for information relevant to other financial statement assertions. Such considerations may influence the auditor’s decision about whether to perform external confirmation procedures.

As detailed in paragraph A51 of ISA 330, there are several factors that may assist the auditor in determining whether external confirmation procedures are to be performed as substantive audit procedures, include:

• The confirming party’s knowledge of the subject matter – responses may be more reliable if provided by a person at the confirming party who has the requisite knowledge about the information being confirmed
• The ability or willingness of the intended confirming party to respond – for example, the confirming party :
• May not accept responsibility for responding to a confirmation request;
• May consider responding too costly or time consuming;
• May have concerns about the potential legal liability resulting from responding;
• May account for transactions in different currencies; or
• May operate in an environment where responding to confirmation requests is not a significant aspect of day-to-day operations

In such situations, confirming parties may not respond, may respond in a casual manner or may attempt to restrict the reliance placed on the response

• The objectivity of the intended confirming party – if the confirming party is a related party of the entity, responses to confirmation requests may be less reliable.

The Importance of External Confirmations as Audit Evidence

ISA 505 deals with the auditor’s use of external confirmation procedures to obtain audit evidence in accordance with the requirements of ISA 330 regarding The Auditor’s Responses to Assessed Risks, and ISA 500 regarding Audit Evidence. It does not address inquiries regarding litigation and claims, which are dealt with in ISA 501 regarding Audit Evidence – Specific Considerations for Selected Items.

ISA 500 indicates that the reliability of audit evidence is influenced by its source and by its nature, and is dependent on the individual circumstances under which it is obtained. That ISA also includes the following generalizations applicable to audit evidence :

• Audit evidence is more reliable when it is obtained from independent sources outside the entity
• Audit evidence obtained directly by the auditor is more reliable than audit evidence obtained indirectly or by inference
• Audit evidence is more reliable when it exists in documentary form, whether paper, electronic or other medium

Accordingly, depending on the circumstances of the audit, audit evidence in the form of external confirmations received directly by the auditor from confirming parties may be more reliable than evidence generated internally by the entity. This ISA is intended to assist the auditor in designing and performing external confirmation procedures to obtain relevant and reliable audit evidence.

Other ISAs recognize the importance of external confirmations as audit evidence, for example :

(1) ISA 330 discusses the auditor’s responsibility to design and implement overall responses to address the assessed risks of material misstatement at the financial statement level, and to design and perform further audit procedures whose nature, timing and extent are based on, and are responsive to, the assessed risks of material misstatement at the assertion level. In addition, ISA 330 requires that, irrespective of the assessed risks of material misstatement, the auditor designs and performs substantive procedures for each material class of transactions, account balance, and disclosure. The auditor is also required to consider whether external confirmation procedures are to be performed as substantive audit procedures

(2)  ISA 330 requires that the auditor obtain more persuasive audit evidence the higher the auditor’s assessment risk. To do this, the auditor may increase the quantity of the evidence or obtain evidence that is more relevant or reliable, or both. For example, the auditor may place more emphasis on obtaining evidence directly from third parties or obtaining corroborating evidence from a number of independent sources. ISA 330 also indicates that external confirmation procedures may assist the auditor in obtaining audit evidence with the high level of reliability that the auditor requires to respond to significant risks of material misstatement, whether due to fraud or error.

(3)  ISA 240 indicates that the auditor may design confirmation requests to obtain additional corroborative information as a response to address the assessed risks of material misstatement due to fraud at the assertion level.

(4)  ISA 500 indicates that corroborating information obtained from a source independent of the entity, such as external confirmations, may increase the assurance the auditor obtains from evidence existing within the accounting records or from representations made by management.

Source of this article : ISA 505 – External Confirmations, paragraphs 1-3

The new rules of Audit Confirmation Process

The Public Company Accounting Oversight Board (PCAOB) on July 13, 2010 approved the publication of a proposed auditing standard regarding Confirmation. In a statement issued with the proposed new standard, PCAOB Acting Chairman Daniel L. Goelzer said the proposal modernizes the current confirmation standard, AU Section 330, The Confirmation Process, and strengthens the confirmation requirements to better protect investors and other users of audited financial statements.

This proposed standard comprises of 36 paragraphs which provides guidance about the confirmation process in audits performed in accordance with generally accepted auditing standards.

It defines the confirmation process (see par. 04), discusses the relationship of confirmation procedures to the auditor’s assessment of audit risk (see par. 05 through 10), describes certain factors that affect the reliability of confirmations (see par. 16 through 27), provides guidance on performing alternative procedures when responses to confirmation requests are not received (see par. 31 and 32). It also provides guidance on evaluating the results of confirmation procedures as states in par. 33.

In par. 05 the standards states that in determining the audit procedures to be applied, including whether they should include confirmation procedure, the auditor uses the audit risk assessment.

In relation with the audit risk assessment (read about the concept of audit risk in here), par. 07 states that the greater the combined assessed level of inherent and control risk, the greater the assurance that the auditor needs from substantive tests related to the financial statement assertion. In this situation, the auditor might use confirmation procedures rather than or in conjunction with tests directed toward documents or parties within the entity.

While par. 06 states that confirmation is undertaken to obtain evidence from third parties about financial statement assertions made by management. In general, as states in Section 326, Evidential Matter, it is presumed that “when evidential matter can be obtained from independent sources outside an entity, it provides greater assurance of reliability for the purposes of an independent audit than that secured solely within the entity.”

There are two types of confirmation requests : the positive and the negative form. If the auditor uses the positive form of confirmation, he or she should considering since there is a risk that recipients of a positive form of confirmation request with the information to be confirmed contained on it may sign and return the confirmation without verifying that the information is correct, blank forms may be used as one way to mitigate this risk.

When the auditor has not received replies to positive confirmation requests, he or she should apply alternative procedures to the non-responses to obtain evidence necessary to reduce audit risk to an acceptably low level. However, the omission of alternative procedures may be acceptable in several circumstances as stated in par. 31 to the standard.

The nature of alternative procedures varies according to the account and assertion in question. In the examination of account receivable, for example, the auditor may conduct the examination of subsequent cash receipts, shipping documents, or other client documentation to provide evidence for the existence assertion.

The complete proposed standard and another related materials are downloadable in here

Comments for the proposed auditing standard are due on September 13, 2010.