Historical scope and what a confirmation can establish
Audit Practice Bulletin 1 of 2010, dated 3 May 2010, follows recurring SSA 505 deficiencies in 2007–2009 practice reviews. A confirmation obtains and evaluates direct information from a knowledgeable third party about balances, transactions or other statement items. It may assist with accuracy, cut-off and irregularities, but assertions differ: receivable confirmations support existence more effectively than completeness or valuation, whereas payable confirmations can support both existence and completeness. The clarified SSA 505 applied to periods beginning on or after 15 December 2009; earlier paragraph 30 corresponded to clarified paragraph 7.
Keep control of sending and receiving
Auditors must control requests, delivery and communications with the intended respondent, reducing interception or alteration risk. Allowing the client to send requests or collect replies undermines that control. If no other route avoids client involvement, the auditor may need to collect a reply directly from the confirming party. Control is part of the evidential process rather than a clerical step that can routinely be delegated to the audited entity.
Authenticate fax and email responses
Electronic replies present risks concerning origin, respondent authority and undetectable alteration, especially when forwarded by the client. Doubts require further evidence under clarified SSA 505.10 and appropriate additional or modified procedures under SSA 500. Verify both source and content, for example by contacting the respondent using an independently verified telephone number. Assess whether the source is secure and controlled, transmission integrity is preserved, and the intended authorised third party responded directly. Check addresses before sending, document authentication work and do not assume an apparently clean electronic reply is reliable.
Sampling design and unresolved exceptions
Sample size must reduce sampling risk to an acceptably low level; accepting less risk normally requires more items. Every sampling unit needs a chance of selection. Statistical sampling combines random selection with probability-based evaluation, including risk measurement; another approach is non-statistical, with the judgement documented. Complete testing for every selected item and investigate all differences. If neither the designed test nor a suitable alternative can be applied, SSA 530.11 treats the item as a control deviation or a substantive misstatement. Consider the original risk assessment and whether deviations or misstatements require larger samples; an inadequate achieved response rate cannot simply be ignored.
Alternative work must cover every non-response in full
SSA 505.12 requires relevant, reliable alternative evidence for each non-response when confirmations are used. Where confirmation is necessary for the chosen sample, alternatives must address the entire unconfirmed balance, not a further sample of that balance. Customer-acknowledged delivery evidence can support the balance when subsequent receipts are absent or insufficient; internally generated sales invoices alone are inadequate. The purpose is to achieve the original assurance level and determine whether additional testing is necessary.
All six categories in the twenty-item illustration
The sample has 20 receivable balances: seven original confirmations without differences; two originals with differences, only one fully reconciled and tested; four clean fax replies, only one authenticated; three non-responses supported by customer-signed or initialled delivery orders; two non-responses without subsequent receipts supported only by sales invoices; and two not validated at all. Adequate evidence exists for 7 + 1 + 1 + 3 = 12 balances. Eight remain inadequately supported, so the planned assurance has not been achieved despite apparent work on most items.
Resolve the one original difference and three fax replies
Reconcile the outstanding original difference regardless of its amount, understand the reconciling items and verify supporting records. Investigate whether exceptions indicate misstatement under SSA 505.14 and project sample misstatements to the population under SSA 530.14. For the three unauthenticated fax replies, evaluate and document reliability, including direct contact with respondents. Circumstances such as economic downturn and heightened fraudulent-reporting risk may require more than routine authentication.
Resolve the other four non-responses and reconsider risk
For the two invoice-only balances, contact the respondent and, where subsequent receipts cannot cover the full balance, inspect evidence of actual goods or services delivery acknowledged by the customer for that entire balance. Assess relevance and reliability under SSA 500.7. The two entirely untested balances also require work: leaving them out is a sample-of-samples approach. Non-response may indicate fraud, error or an unidentified material-misstatement risk; revise assertion-level risk and planned procedures where necessary under SSA 315.31.
Professional scepticism and the bulletin’s status
ACRA expected continued use of confirmations for existence/completeness and greater rigour as businesses expanded overseas amid difficult economic conditions. Clarified SSA 505 remained an inspection focus in 2010. The bulletin explains inspection criteria and supplements standards; it is not an ACRA rule and does not replace prescribed audit standards, methods or procedures. Its example demonstrates evidence sufficiency rather than establishing a fixed sample size for every audit.
Official source
This article independently explains the substantive contents of the official PDF, including the relevant conditions, procedures and annexes. The linked document remains the authoritative source for its original wording, and later changes should be checked separately.
Read the official PDF ↗