A bank confirmation audit procedure is a letter or electronic request that an auditor sends directly to a client’s financial institution to independently verify cash balances, loan obligations, and other banking arrangements. Because the response comes from a third party with no stake in the client’s financial statements, auditors treat it as some of the strongest evidence available. Under PCAOB Auditing Standard AS 2310, auditors of public companies are expected to confirm cash and cash equivalents held by third parties or otherwise obtain evidence by directly accessing the institution’s records.1Public Company Accounting Oversight Board. AS 2310 – The Auditors Use of Confirmation
What the Confirmation Asks the Bank to Verify
The request casts a wide net across the client’s banking relationship. On the deposit side, the bank verifies the balance of every account the client holds, including checking, savings, and certificates of deposit. Those confirmed figures give the auditor independent support that the cash and equivalents on the balance sheet exist and are stated at the right amount.
Loans get equal attention. The bank reports the outstanding principal balance as of the confirmation date, the interest rate, the maturity date, repayment terms, and any collateral the client pledged to secure the debt. Collateral information matters because it tells the auditor which assets are encumbered and need separate disclosure.
The confirmation also targets items that may not appear on the balance sheet at all. Contingent liabilities such as guarantees the client extended to third parties, or letters of credit the bank issued on the client’s behalf, are potential obligations the client must disclose even though no payment has been made. Compensating balances, meaning minimum deposits the client must maintain as part of a lending agreement, restrict available cash and also need disclosure. Unused lines of credit and their terms are typically included as well.
One limitation is worth understanding up front. The standard confirmation form is not designed to uncover information the auditor didn’t ask about. If the client holds a secret account or an undisclosed loan at the same bank, the confirmation will only catch it if the bank volunteers the information or the auditor specifically inquires.
Positive, Negative, and Blank Confirmation Requests
Confirmation requests come in three forms, and the choice depends on how much risk surrounds the account.
- A positive confirmation requires the bank to respond regardless of whether it agrees or disagrees with the information on the request. If no response comes back, the auditor knows something needs follow-up.
- A negative confirmation asks the bank to respond only if it disagrees. Silence is treated as agreement. It suits situations where risk is low and the population is large, but it carries an obvious weakness: an auditor can’t tell a bank that reviewed the figures from a bank that ignored the letter.
- A blank confirmation is a version of the positive form where the auditor leaves the balance field empty and asks the bank to fill it in. Because the bank has to look up the actual figure rather than sign off on a number provided to it, blank confirmations generally produce stronger evidence.
Bank confirmations almost always use the positive form. The stakes around cash and debt are too high for the ambiguity that comes with treating silence as agreement.
The Standard Confirmation Form
Most bank confirmations in the United States use a standardized template jointly developed by the American Bankers Association, the AICPA, and the Bank Administration Institute. The AICPA distributes it as a fillable PDF. One section covers deposit accounts and asks the bank to confirm account numbers, types, and balances. A second section covers loans and asks for outstanding balances, interest rates, maturity dates, and collateral descriptions. A common layout speeds up processing on the bank’s side because personnel see the same structure from every audit firm.
How Auditors Control the Process
The evidentiary value of a bank confirmation depends entirely on the auditor controlling every step. If the client could alter the request or intercept the response, the exercise would be worthless. AS 2310 is clear on this: the auditor selects the items to confirm, sends the request directly to the bank, and receives the response directly from the bank. Once the client signs the authorization letter, the confirmation is out of the client’s hands.
Client Authorization
The process starts with the client signing an authorization letter that accompanies the request. It tells the bank that the client consents to releasing account information to the auditor. Federal privacy law actually permits banks to share information with a client’s auditors without special consent; the Gramm-Leach-Bliley Act contains an exception allowing financial institutions to disclose nonpublic personal information to their “attorneys, accountants, and auditors.”2Office of the Law Revision Counsel. 15 USC 6802 – Obligations With Respect to Disclosures of Personal Information Even so, banks typically won’t process a confirmation without written authorization from the client, and auditing standards treat obtaining that authorization as a required step.
Paper Versus Electronic Delivery
Auditors used to mail paper forms to the bank and wait for a signed response in a sealed envelope. That method still works but creates real risks. Mail is lost or delayed. Sophisticated fraudsters have forged bank letterhead and fabricated responses.
Electronic confirmation platforms have largely replaced paper at major audit firms. Confirmation.com, for example, connects auditors and banks through a secure digital portal and processes confirmations for more than 175,000 audited entities across over 100 countries.3Commodity Futures Trading Commission. Confirmation.com – Secure Confirmation Clearinghouse The auditor submits the request electronically, the bank responds through the same platform, and the system produces an audit trail that makes interception or tampering far more difficult than paper.
Directing the Request to the Right Place
The confirmation needs to reach someone at the bank with visibility into the full client relationship, not a branch manager who only sees one account. Most banks operate centralized confirmation departments for exactly this purpose. Sending the request there avoids partial responses that miss loan accounts or contingent items.
Evaluating the Response
When the confirmation comes back, the first job is verifying that it’s genuine. For paper responses, that means checking official letterhead and an authorized signature. Electronic platforms authenticate the source themselves, which is a large part of why they’ve become the norm.
The core work is comparing every confirmed figure to the client’s records. Deposit balances get traced to the cash accounts in the general ledger. Loan details get matched against debt schedules and interest calculations. Any contingent liabilities or compensating balances the bank reports need to appear in the client’s disclosures.
Handling Differences
The bank balance and the client’s book balance will rarely match exactly, and that’s usually fine. The most common differences are timing items: deposits in transit that the client sent but the bank hasn’t posted, and outstanding checks that the client issued but recipients haven’t cashed. These show up on the bank reconciliation and explain themselves with documentation like deposit slips or check registers.
Differences that can’t be explained by timing are another matter. A material unexplained gap between the bank’s number and the client’s number needs investigation. The auditor traces the discrepancy to specific transactions and resolves it, either to zero or to an amount small enough not to matter. If it can’t be resolved, it becomes a potential misstatement that affects the audit opinion.
Checking for Completeness
The auditor also confirms that the bank responded about every account and relationship listed in the original request. A response noting “no exceptions” still needs scrutiny to make sure it covers all deposit accounts, all loans, and all contingent items. If anything is missing, the auditor follows up until the bank addresses it or performs alternative procedures.
When the Bank Does Not Respond
Banks don’t always reply, and a missing response doesn’t let the auditor skip the account. AS 2310 requires alternative procedures for any item that didn’t get confirmed, and the auditor must also reconsider whether the lack of response changes the risk assessment for the engagement, including fraud risk.1Public Company Accounting Oversight Board. AS 2310 – The Auditors Use of Confirmation
The first step is usually a second request to the bank’s confirmation department. If that also goes unanswered, the auditor turns to substitute procedures that depend on what was being confirmed.
Alternative Procedures for Cash
For deposit balances, one option under AS 2310 is viewing the account information directly on the bank’s secure website. Beyond that, the auditor typically examines the client’s bank statements from the period after the balance sheet date, looking for clearance of outstanding checks and posting of deposits in transit. Tracing large receipts and disbursements from subsequent statements back to the accounting records provides indirect evidence that the account exists and the balance is accurate. The auditor also reviews the bank reconciliation as of the balance sheet date.
Alternative Procedures for Loans and Other Liabilities
When loan confirmations go unanswered, the auditor inspects original signed loan agreements and promissory notes to verify principal amounts, interest rates, and repayment terms. Analyzing the client’s interest expense schedule and tracing payments to cash disbursement records provides indirect evidence that the liability is real. The auditor also reviews board minutes for authorization of new debt or credit facilities and checks correspondence between the client and the bank for unconfirmed guarantees or contingent liabilities.
How Bank Confirmations Help Catch Fraud
Bank confirmations exist partly because client-generated documents can be faked. A dishonest management team can forge bank statements, fabricate deposit slips, or invent accounts that look legitimate on paper. Going straight to the bank bypasses all of that.
Some of the largest corporate frauds in history involved inflated or fictitious cash. Parmalat grew a fake cash account to nearly $5 billion over roughly a decade. HealthSouth’s senior accounting personnel created false documents supporting cash accounts that were overstated by a combined $300 million.4Commodity Futures Trading Commission. How Auditors Can Overcome Confirmation Fraud Challenges Properly executed confirmations sent through independent channels would have surfaced those discrepancies far sooner.
The process isn’t immune to manipulation either. Fraudsters have impersonated bank employees, set up fake websites that mimic real financial institutions, and intercepted paper confirmations before they reached the auditor. Those risks are the reason auditing standards insist on auditor control from start to finish, and the reason electronic platforms with built-in authentication have become the industry standard. A confirmation sent through a verified digital channel to a bank’s registered portal leaves far less room for interception than an envelope dropped in the mail.