A bank confirmation letter is an external confirmation sought directly from the client's bank, independently of the client, to corroborate account balances and other banking relationships as of the audit date. Beyond the closing balance, it should cover liens or charges marked on the account, guarantees and letters of credit issued, overdraft or cash credit limits sanctioned and utilised, and any other relationship the bank holds with the entity, because these are the items a client-prepared schedule is least likely to disclose completely on its own.
The standard format used in India
Indian statutory audits typically use the format prescribed jointly by the ICAI and the Indian Banks' Association for bank confirmations, sent on the firm's letterhead but requiring the client's authorisation since the bank will not release account information without it. The request is addressed to the branch manager and asks the bank to confirm, directly to the auditor, the position as of the balance sheet date.
| Item requested | Why it matters | What is commonly missed if not asked for |
|---|---|---|
| Account numbers and closing balances for every account held | Confirms the full population of accounts, not just the ones the client listed | Dormant accounts, accounts opened and closed during the year, and accounts in the name of a branch or division |
| Nature of each account — current, cash credit, overdraft, EEFC, fixed deposit | Classification and presentation depend on the nature of the facility | A cash credit account shown as a simple current account, hiding the drawing power and sanctioned limit |
| Sanctioned limits and the rate of interest applicable | Needed to test interest computation and classification of borrowings | The interest rate, which the client's own statement rarely states explicitly |
| Liens, charges or set-off rights marked on any account or deposit | A lien restricts the entity's free use of the balance and needs disclosure | A fixed deposit lien-marked against a loan taken by a related party or a group company |
| Guarantees, letters of credit and bills discounted outstanding | These are contingent liabilities or off-balance-sheet exposures requiring disclosure | Guarantees issued on behalf of a related entity, not reflected anywhere in the client's own records |
| Securities and documents held by the bank as collateral | Confirms what has actually been pledged, against what the client's loan file claims | Title deeds or share certificates still held by the bank for a loan already repaid |
The direct-receipt protocol
An external confirmation has audit value only if the auditor controls the sending of the request and the receipt of the response. Both ends of the process have to bypass the client to be worth anything.
- 01Obtain the client's authorisation letter to the bankThe bank will not respond to a third party without the account holder's written authority. This letter is addressed to the bank, not to the auditor, and simply instructs the bank to release the information directly to the audit firm.
- 02Send the confirmation request directly from the audit firm, not through the clientEven where the client offers to courier the letter to save time, the firm should despatch it, or at minimum control the envelope and the bank's mailing or email address used, so there is no opportunity to intercept or alter the request.
- 03Specify a return address or email that goes directly to the audit firmThe response must not be addressed care of the client or routed through the client's finance team, even informally.
- 04Follow up with the bank directly, not by asking the client to follow upIf a response has not arrived, the second and third reminders should also come from the audit firm. A client offering to 'chase the bank for you' defeats the purpose of the exercise.
Regulatory requirement
External confirmations are addressed under SA 505, which requires the auditor to maintain control over the confirmation process, including determining the information requested, selecting the respondent, sending the request, and receiving the response directly. A confirmation obtained through the client, or one the client has had an opportunity to intercept, does not meet this requirement and should not be relied on as an external confirmation.
Reconciling the confirmation against the books
- Agree the confirmed balance to the bank statement balance used in the BRS; any difference between the two needs its own explanation.
- Cross-check every guarantee and letter of credit confirmed by the bank against the client's own contingent liability register — items on one side and not the other are common and both directions matter.
- Verify that every lien or charge confirmed by the bank corresponds to a loan or facility actually recorded in the books; an unexplained lien points to an undisclosed borrowing or an undisclosed related-party transaction.
- Check sanctioned limits confirmed by the bank against the classification used for cash credit or overdraft balances in the financial statements.
Handling a delayed or non-response
Public sector and larger private banks in India are frequently slow to respond to confirmation requests, and a response within the audit timeline cannot always be assumed, particularly for clients with accounts at smaller branches or cooperative banks.
- Send the first request early — well before the final weeks of the audit — rather than waiting for the fieldwork to be substantially complete.
- If no response has arrived by the time other alternative procedures are needed, perform them: trace the balance to a statement obtained from the bank's net banking portal in the presence of client staff, and test the reconciling items between the statement and the books with the same rigour as if the confirmation had been received.
- Document every follow-up attempt with dates, since a pattern of non-response from a particular bank across audits is itself worth noting.
- A non-response is not the same as a negative finding, and should not be treated as evidence of a problem — but it does mean the auditor needs alternative evidence before concluding on that balance.
A confirmation that arrives by email from an address that cannot be verified as the bank's own domain, or a confirmation returned on plain paper without the bank's seal and an identifiable signatory, should be treated with the same scepticism as a missing confirmation. Confirm authenticity by calling the branch using a number obtained independently, not from the letter itself.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Bank, cash & treasuryBank reconciliation audit procedure for statutory auditWhat a BRS must reconcile, the red flags that separate a timing difference from a cover-up, and how many months you actually need to review.
- Bank, cash & treasuryBank guarantee verification in a statutory auditWhy BGs are off-balance-sheet contingent liabilities, confirming with the bank, tracking expiry, and verifying the margin money behind each one.
- Bank, cash & treasuryLoans and borrowings audit checklistSanction letter checks, charge verification against ROC filings, covenant compliance, interest testing, and current/non-current classification.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.