Advanced Auditing, Assurance and Professional Ethics · Audit Evidence

SA 505 External Confirmation Procedures

Updated 5 October 2026 · Fact-checked

SA 505 deals with the auditor's use of external confirmation procedures to obtain audit evidence. The auditor gets a direct written reply from a third party. To solve questions, identify the assertion, choose the information and confirming party, design the request, control sending and receipt, then evaluate replies, non-responses and exceptions.

Understand SA 505 External Confirmation Procedures

An external confirmation is audit evidence obtained as a direct written response to the auditor from a third party (the confirming party), in paper, electronic or other medium. Common examples are bank balances, trade receivable balances, loans from lenders and stock held by third parties.

It matters because evidence from outside the entity, received directly by the auditor, is generally more reliable than evidence produced inside the entity. The auditor therefore uses confirmations to address assertions such as existence of receivables, or completeness of liabilities and terms of agreements.

SA 505 asks you to do four things: decide what to confirm and from whom, design the request, keep control over the whole process, and evaluate what comes back. Control is the key idea. If management handles the request or the reply, the evidence loses its reliability.

A positive confirmation asks the party to reply in all cases, either agreeing the information or giving the information requested. A negative confirmation asks the party to reply only if it disagrees. Negative confirmations give less reliable evidence because silence does not prove the party received and checked the request. A non-response is a failure to reply, or an incomplete reply. An exception is a response that differs from the recorded information.

The auditor performs confirmation procedures when the assessed risk and the evidence needed justify it. If management refuses to allow the auditor to send a confirmation request, the auditor shall inquire about management's reasons, seek audit evidence on their validity and reasonableness, evaluate the effect on the assessment of the risks of material misstatement (including fraud risk), and perform alternative audit procedures. If the refusal is unreasonable, or the alternative procedures cannot give relevant and reliable evidence, the auditor communicates with those charged with governance (SA 260) and determines the implications for the audit and the opinion (SA 705).

Key rules to remember

Management refuses to allow a confirmation request: Inquire reasons → seek audit evidence on validity → evaluate effect on risk assessment → perform alternative procedures; If the refusal is unreasonable, or alternative procedures cannot give relevant and reliable evidence, communicate with those charged with governance (SA 260) and consider the implications for the audit opinion under SA 705.
Design of a request: Assertions + Information to be confirmed + Form (positive/negative) + Prior experience + Confirming party's ability to respond; Also consider the client's name, the address, and the response method, and that replies come directly to the auditor.
Control over requests: Auditor selects, sends and receives directly; Management must not intercept or handle the request or the reply.
Negative confirmation use: Use alone only if ALL conditions are met; Risk of material misstatement is low; a large number of small homogeneous balances; a very low expected exception rate; no reason to believe recipients will disregard the requests.
Non-response: Perform alternative audit procedures to obtain relevant, reliable evidence; Where a positive confirmation is essential to sufficient appropriate evidence, alternative procedures will not provide it.
Evaluating results: Reliability + Non-responses + Exceptions → sufficient appropriate evidence?; Investigate exceptions to see whether they indicate a misstatement, including fraud.

How to solve SA 505 External Confirmation Procedures questions

Use this order for any SA 505 question, whether it is a case MCQ or a written answer in provision-facts-conclusion form.

1Identify the assertion at risk, such as existence of receivables or completeness of borrowings, and the risk of material misstatement.
2Decide the information to confirm and the confirming party, for example account balances, terms of agreements, or stock held by third parties.
3Design the request: choose positive or negative form, make it specific, and address it to the right, knowledgeable person.
4Maintain control: the auditor sends the request and receives the reply directly, and checks the address and the respondent's authority.
5If management refuses permission, ask why, test the validity of the reasons, and perform alternative procedures. If the refusal is unreasonable, or the alternative procedures cannot give relevant and reliable evidence, communicate with those charged with governance and consider the implications for the opinion under SA 705.
6Handle non-responses with alternative procedures, such as examining subsequent receipts or shipping documents.
7Evaluate exceptions and reliability of replies; investigate differences, which may be timing differences or misstatements.
8Conclude on whether sufficient appropriate evidence is obtained and state the effect on the opinion if not.

Quickest way: Four-line SA 505 answer

When to use it: Use when time is short and the question asks what the auditor should do in a given confirmation situation.

Name the issue in one line: control, form of request, refusal, non-response or exception.
State the SA 505 rule in plain words.
Apply it to the facts given, using the client's numbers and names.
Conclude with the action: alternative procedures, investigation, or modification of the opinion.

Common mistakes in SA 505 External Confirmation Procedures

Allowing management to send the requests or collect the replies.
It saves time and the client is cooperative, so students treat it as harmless.
Fix: Write that the auditor must keep control. Replies must come directly to the auditor, or reliability is lost.
Using negative confirmations as the only evidence for high-risk balances.
Students think no reply means agreement.
Fix: Learn the conditions for sole use of negatives and say that negatives give less reliable evidence than positives.
Treating a non-response as an agreement.
Students confuse positive with negative requests.
Fix: For positives, a non-response means no evidence yet. Follow up and perform alternative procedures.
Accepting management's refusal without questions.
Students avoid conflict with the client in the answer.
Fix: State the steps: inquire, evaluate, perform alternative procedures, and communicate with those charged with governance if the refusal is unreasonable or alternative procedures cannot give relevant and reliable evidence. Then consider the effect on the opinion under SA 705.
Ignoring exceptions as small timing differences.
Exceptions often look like cut-off differences.
Fix: Investigate every exception to decide whether it shows a misstatement or a control deficiency, including possible fraud.

Worked examples

Example 1

Case: You are auditing Nova Traders Ltd. Trade receivables are ₹8,40,00,000, spread over 12 large customers, and risk of overstatement is assessed as high. The CFO suggests sending only negative confirmations, and offers to post the requests from the accounts department to save time. Advise.

Show the solution

Issue: the form of request and control over the process.
Rule: negative confirmations are suitable alone only when risk is low, balances are many, small and homogeneous, expected exceptions are very low, and recipients will not disregard requests.
Facts: risk is high and there are only 12 large balances, so the conditions are not met.
Rule on control: the auditor must send requests and receive replies directly; management involvement reduces reliability.
Conclusion: use positive confirmations, sent by your team from the audit office, with replies addressed to you.

Answer: Reject both suggestions. Use positive confirmations for the 12 large balances, and the auditor must dispatch the requests and receive the replies directly, because negative requests do not suit high risk and management handling weakens the evidence.

Example 2

Case: In auditing Rao Industries Ltd, you sent positive confirmations to 20 debtors. Seventeen agreed. Two did not reply even after a second request. One replied that its balance was ₹2,10,000 against ₹2,60,000 in the books because it paid ₹50,000 on 29 March, and the entity recorded it on 3 April. Explain what you do.

Show the solution

Non-response: a positive confirmation is not received, so follow up and then perform alternative procedures.
Alternative procedures: examine subsequent receipts from the two debtors, and check invoices, dispatch records and delivery proof.
Exception: the difference is ₹2,60,000 − ₹2,10,000 = ₹50,000.
Investigate: the debtor says it paid on 29 March, but the entity recorded the receipt on 3 April. The key question is when the entity actually received the money. Obtain the bank statement and the remittance details to check the bank credit date and whether the cheque or transfer reached the entity by 31 March.
If the money was received by 31 March, the receipt belongs to the year. The receivable is overstated by ₹50,000 (₹2,60,000 recorded against ₹2,10,000 actually owed), and this is a cut-off misstatement. Evaluate it under SA 450 and consider whether other receipts around year-end were also recorded late.
If the money was received only after 31 March (for example, the bank credited it on or after 1 April), the recorded balance of ₹2,60,000 was right at year-end. The ₹50,000 is then a reconciling timing difference, with the payment in transit, and there is no misstatement.
Conclusion: decide between the two outcomes on the verified receipt date, and document the reconciliation of the ₹50,000.

Answer: Perform alternative procedures for the two non-responses, and investigate the ₹50,000 exception by verifying the bank credit date and whether the payment reached the entity by 31 March. If it did, receivables are overstated by ₹50,000 and this is a cut-off misstatement to be evaluated and corrected, with the cut-off control considered. If it did not, it is a reconciling timing difference in transit and the books are not misstated.

Exam tips

Answer in provision-facts-conclusion form and use the numbers and names given in the case.
In MCQs, check who controls the request. If management handles it, the evidence is unreliable.
Remember that a non-response to a positive request needs alternative procedures, but silence on a negative request is not strong evidence.
For refusal questions, list inquire, evaluate, alternative procedures and communication with those charged with governance in order.
Always mention investigating exceptions, since they can signal misstatement or fraud.

Practice questions from Audit Evidence

SA 505 External Confirmation Procedures in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

SA 505 External Confirmation Procedures: frequently asked questions

What is the difference between positive and negative confirmation in SA 505?

A positive confirmation asks the party to reply in every case, agreeing or giving the information. A negative confirmation asks for a reply only if the party disagrees. Negatives give less reliable evidence.

When can a negative confirmation be used alone?

Only when risk of material misstatement is low, there are many small homogeneous balances, the expected exception rate is very low, and recipients are not likely to disregard the request. If any condition fails, use positives.

What if management refuses to let me send a confirmation?

Ask why and look for evidence on whether the reasons are valid. Evaluate the effect on your risk assessment and perform alternative procedures. If the refusal is unreasonable, or the alternative procedures cannot give relevant and reliable evidence, communicate with those charged with governance and consider the implications for your opinion under SA 705.

What should I do about a non-response?

Follow up if needed, then perform alternative procedures to get relevant and reliable evidence. Examples are examining later receipts or dispatch documents.