SA 505 requires the auditor, whenever using external confirmation as audit evidence — whether that's a bank, a debtor, a legal counsel, a custodian of securities, a lender, or a related party — to maintain control over the confirmation request and response process from start to finish, to design the request addressed to the right respondent with the right content, and to follow a defined path when a response doesn't arrive or doesn't match: resend, consider alternative procedures, or treat the absence of a reply as a limitation requiring further work, never simply note the non-response and move on.
Positive vs negative confirmation — SA 505's own distinction
| Type | What it asks the respondent to do | When SA 505 says it's appropriate |
|---|---|---|
| Positive confirmation | Reply in all cases, either agreeing or stating the amount believed correct | Standard choice; required where the assessed risk of material misstatement is higher |
| Negative confirmation | Reply only if they disagree with the stated amount | Only appropriate where assessed risk is low, the population is large and of individually immaterial items, and no reason exists to expect respondents to disregard the request |
A negative confirmation that gets no response provides no explicit evidence that the respondent received the request or verified the information — the absence of a reply is not evidence of agreement, and SA 505 is specific that negative confirmations alone, without other substantive procedures, provide less persuasive evidence than positive ones.
What has to happen with non-responses and exceptions
- 01Maintain control over the whole processThe auditor, not the client, should ideally send the request and receive the reply directly, to prevent interception or substitution of the response.
- 02Follow up on non-responsesA second or third request is the typical next step; if responses still don't come in, alternative audit procedures addressing the same assertions have to be performed.
- 03Investigate every exceptionA reply that disagrees with the recorded amount needs investigation into whether it indicates a misstatement, and if so, the implications for other similar balances or assertions.
- 04Evaluate the reliability of each response receivedIncluding whether the response came through a channel that could have been intercepted, and whether the respondent appears knowledgeable and objective enough to answer reliably.
Regulatory requirement
If management requests that the auditor not send a confirmation to a specific party, SA 505 requires the auditor to consider whether the request is reasonable and has valid grounds, and if accepted, to perform alternative procedures. If the request is not reasonable, or alternative procedures cannot be performed satisfactorily, the auditor has to consider the implications for the assessment of risks of material misstatement, including fraud risk, and for the audit opinion.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Bank, cash & treasuryBank confirmation letters: what to request and verifyWhat a bank confirmation covers beyond the balance, how to keep the request genuinely independent, and what to do when the bank is late.
- Revenue, receivables & cut-offDebtors confirmation procedure: balance confirmation in practicePositive versus negative confirmation, selection criteria, handling non-responses and disputes, and the alternative procedures that cover the gap when confirmations fail.
- Audit documentationSA 500: what counts as sufficient appropriate audit evidenceSA 500 isn't a list of acceptable evidence types. It's a reliability hierarchy and a sufficiency test the auditor has to apply to every item on the file.
- Audit documentationManaging audit queries and client responsesLogging outstanding requests with an owner and due date, escalating when documents don't arrive, and closing a query with evidence rather than just a tick.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.