Your balance sheet says your biggest customer owes you 400,000 USD and your bank holds 1.2 million USD in cash. Both numbers came from your own systems — your billing software, your bank feed, your staff's reconciliations. An auditor's job is to be professionally skeptical of exactly that: every figure management produces is a claim, and claims need corroboration. So for the balances that matter most, the auditor goes around you. They write directly to your customer, your bank, and your lawyer, ask those third parties what the balance is from their side, and compare the answers to your books without letting you touch the replies. That request-and-reply loop is an audit confirmation, and under AU-C 505 it is among the most persuasive evidence in the entire audit. This guide walks through the three request types, what gets confirmed and why, how bank and attorney letters work, and what happens when a reply disagrees with your records.
Why a Third Party's Word Beats Your Own Records
Audit evidence sits on a reliability ladder, and evidence created outside the company outranks evidence created inside it. Your AR ledger is your assertion that customers owe you money; a customer's own signed statement that it owes you that amount is independent corroboration of the same fact. A forged invoice can sail through internal review, but it collapses the moment the supposed customer replies that it never bought anything. That is why auditors confirm balances even at companies with strong controls: controls reduce risk, but only an outsider can verify existence.
The persuasiveness hinges on one procedural rule: the auditor must maintain control over the whole loop. The auditor selects which balances to confirm, prepares and sends the requests, and receives the replies directly — not routed through the client's inbox, not handed over by the CFO. A confirmation that passes through management's hands is no longer external evidence; it is a client document with a third party's letterhead. If your audit team insists on sending the letters themselves and having replies come straight back to them, that is not distrust of you personally. It is the procedure working as designed.
Confirmations do not prove everything. An AR confirmation is strong evidence for existence — the receivable is real — but says little about valuation: the customer may owe the money and still go bankrupt before paying. Collectibility still needs an allowance analysis. Likewise, a bank confirmation proves the cash exists at the institution, not that it is unrestricted or correctly classified. Auditors pair confirmations with other procedures rather than treating a clean reply as the end of the story.
The Three Request Types: Positive, Negative, and Blank
Every confirmation takes one of three forms, and the choice is driven by risk, not convenience.
Positive confirmations ask the recipient to reply either way — confirm the stated balance is correct, or say what it actually is. The request states the amount from the client's books ("our records show you owe 48,250 USD at December 31"), and silence is not an answer: every nonresponse must be chased with follow-up requests and, failing that, alternative procedures. Positives are the default for large balances, high-risk accounts, and anywhere the auditor needs strong evidence.
Negative confirmations ask for a reply only if the recipient disagrees. No response is treated as agreement. Because silence is weak evidence, auditing standards restrict negatives to a narrow lane: the auditor may not use them as the sole substantive procedure unless the risk of material misstatement is low, the population is many small homogeneous balances, and there is reason to expect recipients will actually read the request and speak up if it is wrong. Think a bank confirming thousands of small customer deposit balances, not your five biggest receivables.
Blank confirmations state no amount at all — the recipient fills in the balance from its own records. Blanks defeat the lazy-agreement problem, where a busy accounts-payable clerk signs off on a stated figure without checking. They cost more effort on both ends and get lower response rates, so auditors reserve them for situations where the risk of the recipient rubber-stamping a number is itself the concern.
One practical consequence for you as the client: when the auditor asks you to approve the request list and provide accurate contact details, do it fast and do it carefully. Stale addresses and wrong attention-lines are the most common reason confirmations go unanswered, and every unanswered positive creates follow-up work that lands partly on your staff.
Cash and Debt: The Standard Bank Confirmation
Bank confirmations run on rails the profession laid decades ago. The AICPA, the American Bankers Association, and the Bank Administration Institute jointly maintain a standard form — the "standard form to confirm account balance information with financial institutions" — on which the auditor lists the client's deposit accounts and loan balances and the bank verifies them. The form covers balances on deposit and amounts owed to the bank at the balance-sheet date, keeping both sides of the banking relationship in one reply.
Two modern wrinkles matter. First, paper is dying: many large banks no longer answer mailed confirmation letters at all and respond only to electronic requests, either by email sent directly from the auditor or through a designated third-party platform. If your auditor asks you to authorize electronic confirmation access or pay a per-confirmation bank fee, that is the normal plumbing now, not an upsell.
Second, the definition of "cash to confirm" is expanding. Statement on Auditing Standards No. 150, External Confirmations, published in 2026 and effective for periods ending on or after December 15, 2028, will generally require auditors to confirm cash and cash equivalents held by third parties — not just banks and custodians, but balances sitting with payment processors, payroll providers, and escrow agents. If your operating cash scatters across a bank account, a Stripe balance, a payroll funding account, and an escrow holdback, expect each of those to get its own confirmation request in future audits. Early adoption is permitted, so some auditors are already doing it.
Receivables, Payables, and Everything Else Worth Asking About
Accounts receivable is the classic confirmation population: the auditor samples customer balances, with coverage skewed toward the largest accounts, and asks debtors to verify what they owe. Disagreements are common and usually boring — goods in transit at year-end, a payment the customer sent December 31 that you recorded January 2, a disputed credit memo. The audit team reconciles each one, and your AR staff's job is to explain timing differences fast so the team can distinguish cutoff noise from real misstatement.
Confirmations extend well beyond receivables. Auditors routinely confirm notes payable with lenders, and may confirm inventory held by third parties, consigned goods, contract balances on long-term work, related-party transactions, and unusual transactions that deserve an outside voice. Accounts payable confirmations are less common — the primary risk with payables is understatement, and confirming recorded balances does not find liabilities you never recorded — but auditors use them for large or contentious vendor balances. The unifying logic is always the same: where an independent party holds the other half of the record, ask them.
Lawsuits and Claims: The Attorney Letter
Near year-end the auditor sends a different kind of request — to your outside lawyer. The attorney letter (or legal confirmation) asks counsel to verify the completeness and accuracy of management's list of pending litigation, overtly threatened claims, and unasserted claims, and to assess whether any of it is material to the financial statements. It is the auditor's window into contingent liabilities: the lawsuit that has not produced a bill yet but could produce a judgment.
The ground rules come from a 1976 treaty between the professions: the ABA Statement of Policy Regarding Lawyers' Responses to Auditors' Requests for Information, which the auditing standards incorporate. Its key compromise protects attorney-client privilege while giving auditors what they need. Lawyers describe pending and overtly threatened matters being handled, but they do not volunteer unasserted claims — possible claims nobody has yet raised — unless the client specifically identifies the matter in the inquiry letter and asks for comment. The client separately represents to the auditor that it has disclosed every unasserted claim its lawyers have told it is probable of assertion and disclosable under ASC 450.
Expect your lawyer's reply to be narrower than you might hope. Counsel rarely opines on who will win; the ABA policy says outcome opinions are appropriate only in the rare case where the lawyer can state with real confidence that the client will prevail or lose. Instead the letter typically confirms the list of matters, gives a factual status, and notes where an outcome cannot be estimated. The auditor then maps each matter onto the ASC 450 grid — probable and estimable means accrue a liability, reasonably possible means disclose in the footnotes, remote means neither — and checks that your statements did the same. If your lawyer bills you for the letter, that is standard; many firms charge a flat fee for audit-response letters.
When the Reply Disagrees: Exceptions and Nonresponses
A confirmation outcome falls into one of three buckets, and only the first is the end of the story.
Agreement. The third party's number matches your books. The auditor files it and moves on.
Exception. The reply differs from your records. Every exception must be investigated to determine whether it signals misstatement. Most resolve into timing differences — the in-transit payment, the shipment that crossed year-end — or client error, like a credit memo posted to the wrong account. But the auditor cannot assume that: each exception gets worked to a conclusion, and a pattern of exceptions can expand testing or indicate a control weakness. Responses with restrictive language ("this reply is for information only"), oral replies, and replies that arrived via the client rather than directly also get flagged, because each degrades the evidence.
Nonresponse. The recipient never answers a positive confirmation. The auditor sends follow-up requests, and for each balance that still goes unanswered, performs alternative procedures to get the same assurance another way: for receivables, that means examining specific subsequent cash receipts from that customer, plus shipping documentation and sales records near period-end; for payables, subsequent cash disbursements and vendor correspondence. These substitutes work, but they consume more of everyone's time than a reply would have — another reason to give the auditor good contact details and to nudge your big customers to answer.
One situation deserves its own warning: if management refuses to let the auditor confirm a balance at all, the auditor must ask why, get corroborating evidence for the reason, and perform alternative procedures — plus, typically, a pointed addition to the management representation letter. An unreasonable refusal is a scope limitation, and scope limitations can qualify the audit opinion. Objecting to a confirmation is your right; be ready to explain yourself in writing.
Keeping Your Books Confirmation-Ready
Confirmations go smoothly at companies whose own records already agree with the outside world, and the habits that produce that agreement are unglamorous monthly work. Reconcile every bank account every month so the year-end bank reply matches a number you already trust. Keep AR aging clean: apply cash promptly, resolve disputed invoices before year-end, and write off balances you know are dead rather than letting the auditor's letter discover them. Mind cutoff — record shipments and receipts in the period they actually occurred — because cutoff errors are the single biggest source of confirmation exceptions. And keep a current list of every place cash sits, including processor and payroll balances, since SAS 150 is about to make that list audit evidence.
When a confirmation exception does surface a genuinely uncollectible balance, book the write-off instead of carrying hope as an asset. In a plain-text ledger the entry is one stanza — remove the receivable, recognize the loss (see the Beancount documentation for ledger syntax if this format is new to you):
2026-12-31 * "Write off uncollectible invoice 4471 — customer confirmed dispute, collection closed"
Expenses:Bad-Debts 48,250 USD
Assets:Receivables:Customer:AcmeCorp -48,250 USDAttach the confirmation reply and the collection file to the entry as supporting documents. When next year's auditor asks why a 48,250 USD receivable vanished, the answer is one entry with its evidence attached, not a reconstruction from memory.
Before Audit Season Starts
A short checklist, in the order that saves the most time. First, reconcile: close the bank recs, clean the AR aging, and true up cutoff before the auditors arrive, because every exception they find costs both sides hours. Second, assemble your contact list — the AP managers at your largest customers, your bank relationship team, your outside counsel — with current names and addresses, and warn the big customers that an audit letter is coming so it does not die in a generic inbox. Third, approve the auditor's confirmation requests the day they arrive and authorize any electronic-confirmation fees without a procurement saga. Fourth, brief your own staff that replies go straight back to the auditor, never through your office, and that oral "yeah, that's right" answers do not count. Do those four things and confirmations become what they are supposed to be: quiet third-party corroboration that your numbers are what you say they are.
