{"id":"F2009L04088","name":"ASA 505 - External Confirmations - October 2009","slug":"asa-505-external-confirmations-october-2009","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":81660,"registerId":"commonwealth-F2009L04088-current","compilationNumber":null,"startDate":"2026-04-02","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"Obtaining a Copy of this Auditing Standa","sectionType":"section","heading":"Obtaining a Copy of this Auditing Standard","content":"##### Obtaining a Copy of this Auditing Standard\n\nThe most recently compiled versions of Auditing Standards, original Standards and amending Standards (see Compilation Details) are available on the AUASB website: www.auasb.gov.au","sortOrder":0},{"sectionNumber":"Contact Details","sectionType":"section","heading":"Contact Details","content":"##### Contact Details\n\n| Auditing and Assurance Standards BoardPodium Level 14, 530 Collins StreetMelbourne Victoria 3000AUSTRALIA | Phone: (03) 8080 7400E-mail: enquiries@auasb.gov.auPostal Address:PO Box 204Collins Street WestMelbourne Victoria 8007AUSTRALIA |\n| --------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |","sortOrder":1},{"sectionNumber":"COPYRIGHT","sectionType":"section","heading":"COPYRIGHT","content":"##### COPYRIGHT\n\n© 2021 Commonwealth of Australia. The text, graphics and layout of this Auditing Standard are protected by Australian copyright law and the comparable law of other countries. Reproduction within Australia in unaltered form (retaining this notice) is permitted for personal and non‑commercial use subject to the inclusion of an acknowledgment of the source as being the Australian Auditing and Assurance Standards Board (AUASB).\n\nRequests and enquiries concerning reproduction and rights for commercial purposes within Australia should be addressed to the Technical Director, Auditing and Assurance Standards Board, PO Box 204, Collins Street West, Melbourne, Victoria 8007 or sent to [enquiries@auasb.gov.au](mailto:enquiries@auasb.gov.au). Otherwise, no part of this Auditing Standard may be reproduced, stored or transmitted in any form or by any means without the prior written permission of the AUASB except as permitted by law.\n\nThis Auditing Standard reproduces substantial parts of the corresponding International Standard on Auditing issued by the International Auditing and Assurance Standards Board (IAASB) and published by the International Federation of Accountants (IFAC), in the manner described in the statement on Conformity with International Standards on Auditing. The AUASB acknowledges that IFAC is the owner of copyright in the International Standard on Auditing incorporated in this Auditing Standard throughout the world.\n\nAll existing rights in this material are reserved outside Australia. Reproduction outside Australia in unaltered form (retaining this notice) is permitted for personal and non-commercial use only.\n\nFurther information and requests for authorisation to reproduce this Auditing Standard for commercial purposes outside Australia should be addressed to the Technical Director, Auditing and Assurance Standards Board, PO Box 204, Collins Street West, Melbourne, Victoria 8007 or sent to [enquiries@auasb.gov.au](mailto:enquiries@auasb.gov.au). Any decision to approve a request may also require the agreement of IFAC.\n\nISSN 1833-4393","sortOrder":2},{"sectionNumber":"CONTENTS","sectionType":"part","heading":"CONTENTS","content":"# CONTENTS\n\nCOMPILATION DETAILS\n\nAUTHORITY STATEMENT\n\nCONFORMITY WITH INTERNATIONAL STANDARDS ON AUDITING\n\nParagraphs\n\nApplication......................................................Aus 0.1-Aus 0.2\n\nOperative Date.........................................................Aus 0.3\n\nIntroduction\n\nScope of this Auditing Standard..................................................1\n\nExternal Confirmation Procedures to Obtain Audit Evidence............................2-3\n\nEffective Date...............................................................4\n\nObjective..................................................................5\n\nDefinitions.................................................................6\n\nRequirements\n\nExternal Confirmation Procedures.................................................7\n\nManagement’s Refusal to Allow the Auditor to Send a Confirmation Request................8-9\n\nResults of the External Confirmation Procedures...................................10-14\n\nNegative Confirmations.......................................................15\n\nEvaluating the Evidence Obtained................................................16\n\nApplication and Other Explanatory Material\n\nExternal Confirmation Procedures.............................................A1-A7\n\nManagement’s Refusal to Allow the Auditor to Send a Confirmation Request............A8-A10\n\nResults of the External Confirmation Procedures................................A11-A22\n\nNegative Confirmations......................................................A23\n\nEvaluating the Evidence Obtained...........................................A24-A25","sortOrder":3},{"sectionNumber":"COMPILATION DETAILS","sectionType":"part","heading":"COMPILATION DETAILS","content":"##### Obtaining a Copy of this Auditing Standard\n\nThe most recently compiled versions of Auditing Standards, original Standards and amending Standards (see Compilation Details) are available on the AUASB website: www.auasb.gov.au\n\n##### Contact Details\n\n| Auditing and Assurance Standards BoardPodium Level 14, 530 Collins StreetMelbourne Victoria 3000AUSTRALIA | Phone: (03) 8080 7400E-mail: enquiries@auasb.gov.auPostal Address:PO Box 204Collins Street WestMelbourne Victoria 8007AUSTRALIA |\n| --------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |\n\n##### COPYRIGHT\n\n© 2021 Commonwealth of Australia. The text, graphics and layout of this Auditing Standard are protected by Australian copyright law and the comparable law of other countries. Reproduction within Australia in unaltered form (retaining this notice) is permitted for personal and non‑commercial use subject to the inclusion of an acknowledgment of the source as being the Australian Auditing and Assurance Standards Board (AUASB).\n\nRequests and enquiries concerning reproduction and rights for commercial purposes within Australia should be addressed to the Technical Director, Auditing and Assurance Standards Board, PO Box 204, Collins Street West, Melbourne, Victoria 8007 or sent to [enquiries@auasb.gov.au](mailto:enquiries@auasb.gov.au). Otherwise, no part of this Auditing Standard may be reproduced, stored or transmitted in any form or by any means without the prior written permission of the AUASB except as permitted by law.\n\nThis Auditing Standard reproduces substantial parts of the corresponding International Standard on Auditing issued by the International Auditing and Assurance Standards Board (IAASB) and published by the International Federation of Accountants (IFAC), in the manner described in the statement on Conformity with International Standards on Auditing. The AUASB acknowledges that IFAC is the owner of copyright in the International Standard on Auditing incorporated in this Auditing Standard throughout the world.\n\nAll existing rights in this material are reserved outside Australia. Reproduction outside Australia in unaltered form (retaining this notice) is permitted for personal and non-commercial use only.\n\nFurther information and requests for authorisation to reproduce this Auditing Standard for commercial purposes outside Australia should be addressed to the Technical Director, Auditing and Assurance Standards Board, PO Box 204, Collins Street West, Melbourne, Victoria 8007 or sent to [enquiries@auasb.gov.au](mailto:enquiries@auasb.gov.au). Any decision to approve a request may also require the agreement of IFAC.\n\nISSN 1833-4393\n\n# CONTENTS\n\nCOMPILATION DETAILS\n\nAUTHORITY STATEMENT\n\nCONFORMITY WITH INTERNATIONAL STANDARDS ON AUDITING\n\nParagraphs\n\nApplication......................................................Aus 0.1-Aus 0.2\n\nOperative Date.........................................................Aus 0.3\n\nIntroduction\n\nScope of this Auditing Standard..................................................1\n\nExternal Confirmation Procedures to Obtain Audit Evidence............................2-3\n\nEffective Date...............................................................4\n\nObjective..................................................................5\n\nDefinitions.................................................................6\n\nRequirements\n\nExternal Confirmation Procedures.................................................7\n\nManagement’s Refusal to Allow the Auditor to Send a Confirmation Request................8-9\n\nResults of the External Confirmation Procedures...................................10-14\n\nNegative Confirmations.......................................................15\n\nEvaluating the Evidence Obtained................................................16\n\nApplication and Other Explanatory Material\n\nExternal Confirmation Procedures.............................................A1-A7\n\nManagement’s Refusal to Allow the Auditor to Send a Confirmation Request............A8-A10\n\nResults of the External Confirmation Procedures................................A11-A22\n\nNegative Confirmations......................................................A23\n\nEvaluating the Evidence Obtained...........................................A24-A25\n\n  \n\n# COMPILATION DETAILS\n\n### Auditing Standard ASA 505 External Confirmations (as Amended)\n\nThis compilation takes into account amendments made up to and including 3 March 2020 and was prepared on 10 November 2021 by the Auditing and Assurance Standards Board (AUASB).\n\nThis compilation is not a separate Auditing Standard made by the AUASB. Instead, it is a representation of ASA 505 (October 2009) as amended by other Auditing Standards which are listed in the Table below.\n\n##### Table of Standards\n\n| Standard       | Date made       | Operative Date                                                                                         |\n| -------------- | --------------- | ------------------------------------------------------------------------------------------------------ |\n| ASA 505 [A]    | 27 October 2009 | Financial reporting periods commencing on or after 1 January 2010.                                     |\n| ASA 2018-1 [B] | 5 December 2018 | Financial reporting periods commencing on or after 15 December 2019, with early adoption permitted[*]. |\n| ASA 2020-1 [C] | 3 March 2020    | Financial reporting periods commencing on or after 15 December 2021[#]                                 |\n\n\\[A\\] Federal Register of Legislation – registration number F2009L04088, 12 November 2009\n\n\\[B\\] Federal Register of Legislation – registration number F2019L00016, 3 January 2019\n\n\\[C\\] Federal Register of Legislation – registration number F2020L00252, 13 March 2020\n\n##### Table of Amendments\n\n| Paragraph affected | How affected | By … [paragraph] |\n| ------------------ | ------------ | ---------------- |\n| 2Footnote 4        | Amended      | ASA 2018-1 [50]  |\n| 2Footnote 5        | Amended      | ASA 2018-1 [51]  |\n| 3Footnote 11       | Amended      | ASA 2018-1 [52]  |\n| A9Footnote 14      | Amended      | ASA 2020-1 [130] |\n| A17Footnote 18     | Amended      | ASA 2020-1 [131] |\n| A19Footnote 20     | Amended      | ASA 2020-1 [132] |\n\n  \n\n## AUTHORITY STATEMENT\n\nAuditing Standard ASA 505 External Confirmations (as amended to 3 March 2020) is set out in paragraphs Aus 0.1 to A25.\n\nThis Auditing Standard is to be read in conjunction with ASA 101 Preamble to AUASB Standards, which sets out how AUASB Standards are to be understood, interpreted and applied. This Auditing Standard is to be read also in conjunction with ASA 200 Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with Australian Auditing Standards.\n\n##### Conformity with International Standards on Auditing\n\nThis Auditing Standard conforms with International Standard on Auditing ISA 505 External Confirmations, issued by the International Auditing and Assurance Standards Board (IAASB), an independent standard‑setting board of the International Federation of Accountants (IFAC).\n\nParagraphs that have been added to this Auditing Standard (and do not appear in the text of the equivalent ISA) are identified with the prefix “Aus”.\n\nCompliance with this Auditing Standard enables compliance with ISA 505.","sortOrder":4},{"sectionNumber":"Auditing Standard ASA 505 External Confi","sectionType":"division","heading":"Auditing Standard ASA 505 External Confirmations (as Amended)","content":"### Auditing Standard ASA 505 External Confirmations (as Amended)\n\nThis compilation takes into account amendments made up to and including 3 March 2020 and was prepared on 10 November 2021 by the Auditing and Assurance Standards Board (AUASB).\n\nThis compilation is not a separate Auditing Standard made by the AUASB. Instead, it is a representation of ASA 505 (October 2009) as amended by other Auditing Standards which are listed in the Table below.","sortOrder":5},{"sectionNumber":"Table of Standards","sectionType":"section","heading":"Table of Standards","content":"##### Table of Standards\n\n| Standard       | Date made       | Operative Date                                                                                         |\n| -------------- | --------------- | ------------------------------------------------------------------------------------------------------ |\n| ASA 505 [A]    | 27 October 2009 | Financial reporting periods commencing on or after 1 January 2010.                                     |\n| ASA 2018-1 [B] | 5 December 2018 | Financial reporting periods commencing on or after 15 December 2019, with early adoption permitted[*]. |\n| ASA 2020-1 [C] | 3 March 2020    | Financial reporting periods commencing on or after 15 December 2021[#]                                 |\n\n\\[A\\] Federal Register of Legislation – registration number F2009L04088, 12 November 2009\n\n\\[B\\] Federal Register of Legislation – registration number F2019L00016, 3 January 2019\n\n\\[C\\] Federal Register of Legislation – registration number F2020L00252, 13 March 2020","sortOrder":6},{"sectionNumber":"Table of Amendments","sectionType":"section","heading":"Table of Amendments","content":"##### Table of Amendments\n\n| Paragraph affected | How affected | By … [paragraph] |\n| ------------------ | ------------ | ---------------- |\n| 2Footnote 4        | Amended      | ASA 2018-1 [50]  |\n| 2Footnote 5        | Amended      | ASA 2018-1 [51]  |\n| 3Footnote 11       | Amended      | ASA 2018-1 [52]  |\n| A9Footnote 14      | Amended      | ASA 2020-1 [130] |\n| A17Footnote 18     | Amended      | ASA 2020-1 [131] |\n| A19Footnote 20     | Amended      | ASA 2020-1 [132] |\n\n  \n\n## AUTHORITY STATEMENT\n\nAuditing Standard ASA 505 External Confirmations (as amended to 3 March 2020) is set out in paragraphs Aus 0.1 to A25.\n\nThis Auditing Standard is to be read in conjunction with ASA 101 Preamble to AUASB Standards, which sets out how AUASB Standards are to be understood, interpreted and applied. This Auditing Standard is to be read also in conjunction with ASA 200 Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with Australian Auditing Standards.\n\n##### Conformity with International Standards on Auditing\n\nThis Auditing Standard conforms with International Standard on Auditing ISA 505 External Confirmations, issued by the International Auditing and Assurance Standards Board (IAASB), an independent standard‑setting board of the International Federation of Accountants (IFAC).\n\nParagraphs that have been added to this Auditing Standard (and do not appear in the text of the equivalent ISA) are identified with the prefix “Aus”.\n\nCompliance with this Auditing Standard enables compliance with ISA 505.","sortOrder":7},{"sectionNumber":"AUTHORITY STATEMENT","sectionType":"part","heading":"AUTHORITY STATEMENT","content":"## AUTHORITY STATEMENT\n\nAuditing Standard ASA 505 External Confirmations (as amended to 3 March 2020) is set out in paragraphs Aus 0.1 to A25.\n\nThis Auditing Standard is to be read in conjunction with ASA 101 Preamble to AUASB Standards, which sets out how AUASB Standards are to be understood, interpreted and applied. This Auditing Standard is to be read also in conjunction with ASA 200 Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with Australian Auditing Standards.","sortOrder":8},{"sectionNumber":"Conformity with International Standards ","sectionType":"section","heading":"Conformity with International Standards on Auditing","content":"##### Conformity with International Standards on Auditing\n\nThis Auditing Standard conforms with International Standard on Auditing ISA 505 External Confirmations, issued by the International Auditing and Assurance Standards Board (IAASB), an independent standard‑setting board of the International Federation of Accountants (IFAC).\n\nParagraphs that have been added to this Auditing Standard (and do not appear in the text of the equivalent ISA) are identified with the prefix “Aus”.\n\nCompliance with this Auditing Standard enables compliance with ISA 505.","sortOrder":9},{"sectionNumber":"Auditing Standard ASA 505","sectionType":"part","heading":"Auditing Standard ASA 505","content":"Auditing Standard ASA 505\n\nThe Auditing and Assurance Standards Board (AUASB) made Auditing Standard ASA 505 External Confirmations pursuant to section 227B of the Australian Securities and Investments Commission Act 2001 and section 336 of the Corporations Act 2001, on 27 October 2009.\n\nThis compiled version of ASA 505 incorporates subsequent amendments contained in other Auditing Standards made by the AUASB up to and including 3 March 2020 (see Compilation Details).\n\n## Auditing Standard ASA 505\n\n### External Confirmations\n\n##### Application\n\nAus 0.1 This Auditing Standard applies to:\n\n(a) an audit of a financial report for a financial year, or an audit of a financial report for a half-year, in accordance with the Corporations Act 2001; and\n\n(b) an audit of a financial report, or a complete set of financial statements, for any other purpose.\n\nAus 0.2 This Auditing Standard also applies, as appropriate, to an audit of other historical financial information.\n\n##### Operative Date\n\nAus 0.3 This Auditing Standard is operative for financial reporting periods commencing on or after 1 January 2010. \\[Note: For operative dates of paragraphs changed or added by an Amending Standard, see Compilation Details.\\]\n\n##### Introduction\n\n###### Scope of this Auditing Standard\n\n1.  This Auditing Standard deals with the auditor’s use of external confirmation procedures to obtain audit evidence in accordance with the requirements of ASA 330[\\[1\\]](#_ftn3) and ASA 500[\\[2\\]](#_ftn4). It does not address enquiries regarding litigation and claims, which are dealt with in ASA 502.[\\[3\\]](#_ftn5)\n\n###### External Confirmation Procedures to Obtain Audit Evidence\n\n1.  ASA 500 indicates that the reliability of audit evidence is influenced by its source and by its nature, and is dependent on the individual circumstances under which it is obtained.[\\[4\\]](#_ftn6) That Auditing Standard also includes the following generalisations applicable to audit evidence:[\\[5\\]](#_ftn7)\n\n-   Audit evidence is more reliable when it is obtained from independent sources outside the entity.\n-   Audit evidence obtained directly by the auditor is more reliable than audit evidence obtained indirectly or by inference.\n-   Audit evidence is more reliable when it exists in documentary form, whether paper, electronic or other medium.\n\nAccordingly, depending on the circumstances of the audit, audit evidence in the form of external confirmations received directly by the auditor from confirming parties may be more reliable than evidence generated internally by the entity. This Auditing Standard is intended to assist the auditor in designing and performing external confirmation procedures to obtain relevant and reliable audit evidence.\n\n1.  Other Auditing Standards recognise the importance of external confirmations as audit evidence, for example:\n\n-   ASA 330 discusses the auditor’s responsibility to design and implement overall responses to address the assessed risks of material misstatement at the financial statement level, and to design and perform further audit procedures whose nature, timing and extent are based on, and are responsive to, the assessed risks of material misstatement at the assertion level.[\\[6\\]](#_ftn8) In addition, ASA 330 requires that, irrespective of the assessed risks of material misstatement, the auditor designs and performs substantive procedures for each material class of transactions, account balance, and disclosure. The auditor is also required to consider whether external confirmation procedures are to be performed as substantive audit procedures.[\\[7\\]](#_ftn9)\n-   ASA 330 requires that the auditor obtain more persuasive audit evidence the higher the auditor’s assessment of risk.[\\[8\\]](#_ftn10) To do this, the auditor may increase the quantity of the evidence or obtain evidence that is more relevant or reliable, or both. For example, the auditor may place more emphasis on obtaining evidence directly from third parties or obtaining corroborating evidence from a number of independent sources. ASA 330 also indicates that external confirmation procedures may assist the auditor in obtaining audit evidence with the high level of reliability that the auditor requires to respond to significant risks of material misstatement, whether due to fraud or error.[\\[9\\]](#_ftn11)\n-   ASA 240 indicates that the auditor may design confirmation requests to obtain additional corroborative information as a response to address the assessed risks of material misstatement due to fraud at the assertion level.[\\[10\\]](#_ftn12)\n-   ASA 500 indicates that corroborating information obtained from a source independent of the entity, such as external confirmations, may increase the assurance the auditor obtains from evidence existing within the accounting records or from representations made by management.[\\[11\\]](#_ftn13)\n\n###### Effective Date\n\n1.  \\[Deleted by the AUASB. Refer Aus 0.3\\]\n\n##### Objective\n\n1.  The objective of the auditor, when using external confirmation procedures, is to design and perform such procedures to obtain relevant and reliable audit evidence.\n\n##### Definitions\n\n1.  For purposes of the Australian Auditing Standards, the following terms have the meanings attributed below:\n    1.  External confirmation means audit evidence obtained as a direct written response to the auditor from a third party (the confirming party), in paper form, or by electronic or other medium.\n    2.  Positive confirmation request means a request that the confirming party respond directly to the auditor indicating whether the confirming party agrees or disagrees with the information in the request, or providing the requested information.\n    3.  Negative confirmation request means a request that the confirming party respond directly to the auditor only if the confirming party disagrees with the information provided in the request.\n    4.  Non-response means a failure of the confirming party to respond, or fully respond, to a positive confirmation request, or a confirmation request returned undelivered.\n    5.  Exception means a response that indicates a difference between information requested to be confirmed, or contained in the entity’s records, and information provided by the confirming party.\n\n##### Requirements\n\n###### External Confirmation Procedures\n\n1.  When using external confirmation procedures, the auditor shall maintain control over external confirmation requests, including:\n    1.  Determining the information to be confirmed or requested; (Ref: Para. A1)\n    2.  Selecting the appropriate confirming party; (Ref: Para. A2)\n    3.  Designing the confirmation requests, including determining that requests are properly addressed and contain return information for responses to be sent directly to the auditor; and (Ref: Para. A3-A6)\n    4.  Sending the requests, including follow-up requests when applicable, to the confirming party. (Ref: Para. A7)\n\n###### Management’s Refusal to Allow the Auditor to Send a Confirmation Request\n\n1.  If management refuses to allow the auditor to send a confirmation request, the auditor shall:\n    1.  Enquire as to management’s reasons for the refusal, and seek audit evidence as to their validity and reasonableness; (Ref: Para. A8)\n    2.  Evaluate the implications of management’s refusal on the auditor’s assessment of the relevant risks of material misstatement, including the risk of fraud, and on the nature, timing and extent of other audit procedures; and (Ref: Para. A9)\n    3.  Perform alternative audit procedures designed to obtain relevant and reliable audit evidence. (Ref: Para. A10)\n2.  If the auditor concludes that management’s refusal to allow the auditor to send a confirmation request is unreasonable, or the auditor is unable to obtain relevant and reliable audit evidence from alternative audit procedures, the auditor shall communicate with those charged with governance in accordance with ASA 260.[\\[12\\]](#_ftn14) The auditor also shall determine the implications for the audit and the auditor’s opinion in accordance with ASA 705.[\\[13\\]](#_ftn15)\n\n###### Results of the External Confirmation Procedures\n\nReliability of Responses to Confirmation Requests\n\n1.  If the auditor identifies factors that give rise to doubts about the reliability of the response to a confirmation request, the auditor shall obtain further audit evidence to resolve those doubts.  \n    (Ref: Para. A11-A16)\n2.  If the auditor determines that a response to a confirmation request is not reliable, the auditor shall evaluate the implications on the assessment of the relevant risks of material misstatement, including the risk of fraud, and on the related nature, timing and extent of other audit procedures. (Ref: Para. A17)\n\nNon-Responses\n\n1.  In the case of each non-response, the auditor shall perform alternative audit procedures to obtain relevant and reliable audit evidence. (Ref: Para A18-A19)\n\nWhen a Response to a Positive Confirmation Request Is Necessary to Obtain Sufficient Appropriate Audit Evidence\n\n1.  If the auditor has determined that a response to a positive confirmation request is necessary to obtain sufficient appropriate audit evidence, alternative audit procedures will not provide the audit evidence the auditor requires. If the auditor does not obtain such confirmation, the auditor shall determine the implications for the audit and the auditor’s opinion in accordance with ASA 705. (Ref: Para A20)\n\nExceptions\n\n1.  The auditor shall investigate exceptions to determine whether or not they are indicative of misstatements. (Ref: Para. A21-A22)\n\n###### Negative Confirmations\n\n1.  Negative confirmations provide less persuasive audit evidence than positive confirmations. Accordingly, the auditor shall not use negative confirmation requests as the sole substantive audit procedure to address an assessed risk of material misstatement at the assertion level unless all of the following are present: (Ref: Para. A23)\n    1.  The auditor has assessed the risk of material misstatement as low and has obtained sufficient appropriate audit evidence regarding the operating effectiveness of controls relevant to the assertion;\n    2.  The population of items subject to negative confirmation procedures comprises a large number of small, homogeneous, account balances, transactions or conditions;\n    3.  A very low exception rate is expected; and\n    4.  The auditor is not aware of circumstances or conditions that would cause recipients of negative confirmation requests to disregard such requests.\n\n###### Evaluating the Evidence Obtained\n\n1.  The auditor shall evaluate whether the results of the external confirmation procedures provide relevant and reliable audit evidence, or whether further audit evidence is necessary.  \n    (Ref: Para A24-A25)\n\n\\* \\* \\*\n\n##### Application and Other Explanatory Material\n\n###### External Confirmation Procedures\n\nDetermining the Information to Be Confirmed or Requested (Ref: Para. 7(a))\n\n1.  External confirmation procedures frequently are performed to confirm or request information regarding account balances and their elements. They may also be used to confirm terms of agreements, contracts, or transactions between an entity and other parties, or to confirm the absence of certain conditions, such as a “side agreement.”\n\nSelecting the Appropriate Confirming Party (Ref: Para. 7(b))\n\n1.  Responses to confirmation requests provide more relevant and reliable audit evidence when confirmation requests are sent to a confirming party the auditor believes is knowledgeable about the information to be confirmed. For example, a financial institution official who is knowledgeable about the transactions or arrangements for which confirmation is requested may be the most appropriate person at the financial institution from whom to request confirmation.\n\nDesigning Confirmation Requests (Ref: Para. 7(c))\n\n1.  The design of a confirmation request may directly affect the confirmation response rate, and the reliability and the nature of the audit evidence obtained from responses.\n2.  Factors to consider when designing confirmation requests include:\n\n-   The assertions being addressed.\n-   Specific identified risks of material misstatement, including fraud risks.\n-   The layout and presentation of the confirmation request.\n-   Prior experience on the audit or similar engagements.\n-   The method of communication (for example, in paper form, or by electronic or other medium).\n-   Management’s authorisation or encouragement to the confirming parties to respond to the auditor. Confirming parties may only be willing to respond to a confirmation request containing management’s authorisation.\n-   The ability of the intended confirming party to confirm or provide the requested information (for example, individual invoice amount versus total balance).\n\n1.  A positive external confirmation request asks the confirming party to reply to the auditor in all cases, either by indicating the confirming party’s agreement with the given information, or by asking the confirming party to provide information. A response to a positive confirmation request ordinarily is expected to provide reliable audit evidence. There is a risk, however, that a confirming party may reply to the confirmation request without verifying that the information is correct. The auditor may reduce this risk by using positive confirmation requests that do not state the amount (or other information) on the confirmation request, and ask the confirming party to fill in the amount or furnish other information. On the other hand, use of this type of “blank” confirmation request may result in lower response rates because additional effort is required of the confirming parties.\n2.  Determining that requests are properly addressed includes testing the validity of some or all of the addresses on confirmation requests before they are sent out.\n\nFollow-Up on Confirmation Requests (Ref: Para. 7(d))\n\n1.  The auditor may send an additional confirmation request when a reply to a previous request has not been received within a reasonable time. For example, the auditor may, having re-verified the accuracy of the original address, send an additional or follow-up request.\n\n###### Management’s Refusal to Allow the Auditor to Send a Confirmation Request\n\nReasonableness of Management’s Refusal (Ref: Para. 8(a))\n\n1.  A refusal by management to allow the auditor to send a confirmation request is a limitation on the audit evidence the auditor may wish to obtain. The auditor is therefore required to enquire as to the reasons for the limitation. A common reason advanced is the existence of a legal dispute or ongoing negotiation with the intended confirming party, the resolution of which may be affected by an untimely confirmation request. The auditor is required to seek audit evidence as to the validity and reasonableness of the reasons because of the risk that management may be attempting to deny the auditor access to audit evidence that may reveal fraud or error.\n\nImplications for the Assessment of Risks of Material Misstatement (Ref: Para. 8(b))\n\n1.  The auditor may conclude from the evaluation in paragraph 8(b) that it would be appropriate to revise the assessment of the risks of material misstatement at the assertion level and modify planned audit procedures in accordance with ASA 315.[\\[14\\]](#_ftn16) For example, if management’s request to not confirm is unreasonable, this may indicate a fraud risk factor that requires evaluation in accordance with ASA 240.[\\[15\\]](#_ftn17)\n\nAlternative Audit Procedures (Ref: Para. 8(c))\n\n1.  The alternative audit procedures performed may be similar to those appropriate for a non-response as set out in paragraphs A18-A19 of this Auditing Standard. Such procedures also would take account of the results of the auditor’s evaluation in paragraph 8(b) of this Auditing Standard.\n\n###### Results of the External Confirmation Procedures\n\nReliability of Responses to Confirmation Requests (Ref: Para. 10)\n\n1.  ASA 500 indicates that even when audit evidence is obtained from sources external to the entity, circumstances may exist that affect its reliability.[\\[16\\]](#_ftn18) All responses carry some risk of interception, alteration or fraud. Such risk exists regardless of whether a response is obtained in paper form, or by electronic or other medium. Factors that may indicate doubts about the reliability of a response include that it:\n\n-   Was received by the auditor indirectly; or\n-   Appeared not to come from the originally intended confirming party.\n\n1.  Responses received electronically, for example by facsimile or electronic mail, involve risks as to reliability because proof of origin and authority of the respondent may be difficult to establish, and alterations may be difficult to detect. A process used by the auditor and the respondent that creates a secure environment for responses received electronically may mitigate these risks. If the auditor is satisfied that such a process is secure and properly controlled, the reliability of the related responses is enhanced. An electronic confirmation process might incorporate various techniques for validating the identity of a sender of information in electronic form, for example, through the use of encryption, electronic digital signatures, and procedures to verify web site authenticity.\n2.  If a confirming party uses a third party to coordinate and provide responses to confirmation requests, the auditor may perform procedures to address the risks that:\n    1.  The response may not be from the proper source;\n    2.  A respondent may not be authorised to respond; and\n    3.  The integrity of the transmission may have been compromised.\n3.  The auditor is required by ASA 500 to determine whether to modify or add procedures to resolve doubts over the reliability of information to be used as audit evidence.[\\[17\\]](#_ftn19) The auditor may choose to verify the source and contents of a response to a confirmation request by contacting the confirming party. For example, when a confirming party responds by electronic mail, the auditor may telephone the confirming party to determine whether the confirming party did, in fact, send the response. When a response has been returned to the auditor indirectly (for example, because the confirming party incorrectly addressed it to the entity rather than to the auditor), the auditor may request the confirming party to respond in writing directly to the auditor.\n4.  On its own, an oral response to a confirmation request does not meet the definition of an external confirmation because it is not a direct written response to the auditor. However, upon obtaining an oral response to a confirmation request, the auditor may, depending on the circumstances, request the confirming party to respond in writing directly to the auditor. If no such response is received, in accordance with paragraph 12, the auditor seeks other audit evidence to support the information in the oral response.\n5.  A response to a confirmation request may contain restrictive language regarding its use. Such restrictions do not necessarily invalidate the reliability of the response as audit evidence.\n\nUnreliable Responses (Ref: Para. 11)\n\n1.  When the auditor concludes that a response is unreliable, the auditor may need to revise the assessment of the risks of material misstatement at the assertion level and modify planned audit procedures accordingly, in accordance with ASA 315.[\\[18\\]](#_ftn20) For example, an unreliable response may indicate a fraud risk factor that requires evaluation in accordance with ASA 240.[\\[19\\]](#_ftn21)\n\nNon-Responses (Ref: Para. 12)\n\n1.  Examples of alternative audit procedures the auditor may perform include:\n\n-   For accounts receivable balances – examining specific subsequent cash receipts, shipping documentation, and sales near the period-end.\n-   For accounts payable balances – examining subsequent cash disbursements or correspondence from third parties, and other records, such as goods received notes.\n\n1.  The nature and extent of alternative audit procedures are affected by the account and assertion in question. A non-response to a confirmation request may indicate a previously unidentified risk of material misstatement. In such situations, the auditor may need to revise the assessed risk of material misstatement at the assertion level, and modify planned audit procedures, in accordance with ASA 315.[\\[20\\]](#_ftn22) For example, fewer responses to confirmation requests than anticipated, or a greater number of responses than anticipated, may indicate a previously unidentified fraud risk factor that requires evaluation in accordance with ASA 240.[\\[21\\]](#_ftn23)\n\nWhen a Response to a Positive Confirmation Request Is Necessary to Obtain Sufficient Appropriate Audit Evidence (Ref. Para. 13)\n\n1.  In certain circumstances, the auditor may identify an assessed risk of material misstatement at the assertion level for which a response to a positive confirmation request is necessary to obtain sufficient appropriate audit evidence. Such circumstances may include where:\n\n-   The information available to corroborate management’s assertion(s) is only available outside the entity.\n-   Specific fraud risk factors, such as the risk of management override of controls, or the risk of collusion which can involve employee(s) and/or management, prevent the auditor from relying on evidence from the entity.\n\nExceptions (Ref: Para. 14)\n\n1.  Exceptions noted in responses to confirmation requests may indicate misstatements or potential misstatements in the financial statements. When a misstatement is identified, the auditor is required by ASA 240 to evaluate whether such misstatement is indicative of fraud.[\\[22\\]](#_ftn24) Exceptions may provide a guide to the quality of responses from similar confirming parties or for similar accounts. Exceptions also may indicate a deficiency, or deficiencies, in the entity’s internal control over financial reporting.\n2.  Some exceptions do not represent misstatements. For example, the auditor may conclude that differences in responses to confirmation requests are due to timing, measurement, or clerical errors in the external confirmation procedures.\n\n###### Negative Confirmations (Ref: Para. 15)\n\n1.  The failure to receive a response to a negative confirmation request does not explicitly indicate receipt by the intended confirming party of the confirmation request or verification of the accuracy of the information contained in the request. Accordingly, a failure of a confirming party to respond to a negative confirmation request provides significantly less persuasive audit evidence than does a response to a positive confirmation request. Confirming parties also may be more likely to respond indicating their disagreement with a confirmation request when the information in the request is not in their favour, and less likely to respond otherwise. For example, holders of bank deposit accounts may be more likely to respond if they believe that the balance in their account is understated in the confirmation request, but may be less likely to respond when they believe the balance is overstated. Therefore, sending negative confirmation requests to holders of bank deposit accounts may be a useful procedure in considering whether such balances may be understated, but is unlikely to be effective if the auditor is seeking evidence regarding overstatement.\n\n  \n\n###### Evaluating the Evidence Obtained (Ref: Para. 16)\n\n1.  When evaluating the results of individual external confirmation requests, the auditor may categorise such results as follows:\n    1.  A response by the appropriate confirming party indicating agreement with the information provided in the confirmation request, or providing requested information without exception;\n    2.  A response deemed unreliable;\n    3.  A non-response; or\n    4.  A response indicating an exception.\n2.  The auditor’s evaluation, when taken into account with other audit procedures the auditor may have performed, may assist the auditor in concluding whether sufficient appropriate audit evidence has been obtained or whether further audit evidence is necessary, as required by ASA 330.[\\[23\\]](#_ftn25)","sortOrder":10},{"sectionNumber":"External Confirmations","sectionType":"division","heading":"External Confirmations","content":"Auditing Standard ASA 505\n\nThe Auditing and Assurance Standards Board (AUASB) made Auditing Standard ASA 505 External Confirmations pursuant to section 227B of the Australian Securities and Investments Commission Act 2001 and section 336 of the Corporations Act 2001, on 27 October 2009.\n\nThis compiled version of ASA 505 incorporates subsequent amendments contained in other Auditing Standards made by the AUASB up to and including 3 March 2020 (see Compilation Details).\n\n## Auditing Standard ASA 505\n\n### External Confirmations\n\n##### Application\n\nAus 0.1 This Auditing Standard applies to:\n\n(a) an audit of a financial report for a financial year, or an audit of a financial report for a half-year, in accordance with the Corporations Act 2001; and\n\n(b) an audit of a financial report, or a complete set of financial statements, for any other purpose.\n\nAus 0.2 This Auditing Standard also applies, as appropriate, to an audit of other historical financial information.\n\n##### Operative Date\n\nAus 0.3 This Auditing Standard is operative for financial reporting periods commencing on or after 1 January 2010. \\[Note: For operative dates of paragraphs changed or added by an Amending Standard, see Compilation Details.\\]\n\n##### Introduction\n\n###### Scope of this Auditing Standard\n\n1.  This Auditing Standard deals with the auditor’s use of external confirmation procedures to obtain audit evidence in accordance with the requirements of ASA 330[\\[1\\]](#_ftn3) and ASA 500[\\[2\\]](#_ftn4). It does not address enquiries regarding litigation and claims, which are dealt with in ASA 502.[\\[3\\]](#_ftn5)\n\n###### External Confirmation Procedures to Obtain Audit Evidence\n\n1.  ASA 500 indicates that the reliability of audit evidence is influenced by its source and by its nature, and is dependent on the individual circumstances under which it is obtained.[\\[4\\]](#_ftn6) That Auditing Standard also includes the following generalisations applicable to audit evidence:[\\[5\\]](#_ftn7)\n\n-   Audit evidence is more reliable when it is obtained from independent sources outside the entity.\n-   Audit evidence obtained directly by the auditor is more reliable than audit evidence obtained indirectly or by inference.\n-   Audit evidence is more reliable when it exists in documentary form, whether paper, electronic or other medium.\n\nAccordingly, depending on the circumstances of the audit, audit evidence in the form of external confirmations received directly by the auditor from confirming parties may be more reliable than evidence generated internally by the entity. This Auditing Standard is intended to assist the auditor in designing and performing external confirmation procedures to obtain relevant and reliable audit evidence.\n\n1.  Other Auditing Standards recognise the importance of external confirmations as audit evidence, for example:\n\n-   ASA 330 discusses the auditor’s responsibility to design and implement overall responses to address the assessed risks of material misstatement at the financial statement level, and to design and perform further audit procedures whose nature, timing and extent are based on, and are responsive to, the assessed risks of material misstatement at the assertion level.[\\[6\\]](#_ftn8) In addition, ASA 330 requires that, irrespective of the assessed risks of material misstatement, the auditor designs and performs substantive procedures for each material class of transactions, account balance, and disclosure. The auditor is also required to consider whether external confirmation procedures are to be performed as substantive audit procedures.[\\[7\\]](#_ftn9)\n-   ASA 330 requires that the auditor obtain more persuasive audit evidence the higher the auditor’s assessment of risk.[\\[8\\]](#_ftn10) To do this, the auditor may increase the quantity of the evidence or obtain evidence that is more relevant or reliable, or both. For example, the auditor may place more emphasis on obtaining evidence directly from third parties or obtaining corroborating evidence from a number of independent sources. ASA 330 also indicates that external confirmation procedures may assist the auditor in obtaining audit evidence with the high level of reliability that the auditor requires to respond to significant risks of material misstatement, whether due to fraud or error.[\\[9\\]](#_ftn11)\n-   ASA 240 indicates that the auditor may design confirmation requests to obtain additional corroborative information as a response to address the assessed risks of material misstatement due to fraud at the assertion level.[\\[10\\]](#_ftn12)\n-   ASA 500 indicates that corroborating information obtained from a source independent of the entity, such as external confirmations, may increase the assurance the auditor obtains from evidence existing within the accounting records or from representations made by management.[\\[11\\]](#_ftn13)\n\n###### Effective Date\n\n1.  \\[Deleted by the AUASB. Refer Aus 0.3\\]\n\n##### Objective\n\n1.  The objective of the auditor, when using external confirmation procedures, is to design and perform such procedures to obtain relevant and reliable audit evidence.\n\n##### Definitions\n\n1.  For purposes of the Australian Auditing Standards, the following terms have the meanings attributed below:\n    1.  External confirmation means audit evidence obtained as a direct written response to the auditor from a third party (the confirming party), in paper form, or by electronic or other medium.\n    2.  Positive confirmation request means a request that the confirming party respond directly to the auditor indicating whether the confirming party agrees or disagrees with the information in the request, or providing the requested information.\n    3.  Negative confirmation request means a request that the confirming party respond directly to the auditor only if the confirming party disagrees with the information provided in the request.\n    4.  Non-response means a failure of the confirming party to respond, or fully respond, to a positive confirmation request, or a confirmation request returned undelivered.\n    5.  Exception means a response that indicates a difference between information requested to be confirmed, or contained in the entity’s records, and information provided by the confirming party.\n\n##### Requirements\n\n###### External Confirmation Procedures\n\n1.  When using external confirmation procedures, the auditor shall maintain control over external confirmation requests, including:\n    1.  Determining the information to be confirmed or requested; (Ref: Para. A1)\n    2.  Selecting the appropriate confirming party; (Ref: Para. A2)\n    3.  Designing the confirmation requests, including determining that requests are properly addressed and contain return information for responses to be sent directly to the auditor; and (Ref: Para. A3-A6)\n    4.  Sending the requests, including follow-up requests when applicable, to the confirming party. (Ref: Para. A7)\n\n###### Management’s Refusal to Allow the Auditor to Send a Confirmation Request\n\n1.  If management refuses to allow the auditor to send a confirmation request, the auditor shall:\n    1.  Enquire as to management’s reasons for the refusal, and seek audit evidence as to their validity and reasonableness; (Ref: Para. A8)\n    2.  Evaluate the implications of management’s refusal on the auditor’s assessment of the relevant risks of material misstatement, including the risk of fraud, and on the nature, timing and extent of other audit procedures; and (Ref: Para. A9)\n    3.  Perform alternative audit procedures designed to obtain relevant and reliable audit evidence. (Ref: Para. A10)\n2.  If the auditor concludes that management’s refusal to allow the auditor to send a confirmation request is unreasonable, or the auditor is unable to obtain relevant and reliable audit evidence from alternative audit procedures, the auditor shall communicate with those charged with governance in accordance with ASA 260.[\\[12\\]](#_ftn14) The auditor also shall determine the implications for the audit and the auditor’s opinion in accordance with ASA 705.[\\[13\\]](#_ftn15)\n\n###### Results of the External Confirmation Procedures\n\nReliability of Responses to Confirmation Requests\n\n1.  If the auditor identifies factors that give rise to doubts about the reliability of the response to a confirmation request, the auditor shall obtain further audit evidence to resolve those doubts.  \n    (Ref: Para. A11-A16)\n2.  If the auditor determines that a response to a confirmation request is not reliable, the auditor shall evaluate the implications on the assessment of the relevant risks of material misstatement, including the risk of fraud, and on the related nature, timing and extent of other audit procedures. (Ref: Para. A17)\n\nNon-Responses\n\n1.  In the case of each non-response, the auditor shall perform alternative audit procedures to obtain relevant and reliable audit evidence. (Ref: Para A18-A19)\n\nWhen a Response to a Positive Confirmation Request Is Necessary to Obtain Sufficient Appropriate Audit Evidence\n\n1.  If the auditor has determined that a response to a positive confirmation request is necessary to obtain sufficient appropriate audit evidence, alternative audit procedures will not provide the audit evidence the auditor requires. If the auditor does not obtain such confirmation, the auditor shall determine the implications for the audit and the auditor’s opinion in accordance with ASA 705. (Ref: Para A20)\n\nExceptions\n\n1.  The auditor shall investigate exceptions to determine whether or not they are indicative of misstatements. (Ref: Para. A21-A22)\n\n###### Negative Confirmations\n\n1.  Negative confirmations provide less persuasive audit evidence than positive confirmations. Accordingly, the auditor shall not use negative confirmation requests as the sole substantive audit procedure to address an assessed risk of material misstatement at the assertion level unless all of the following are present: (Ref: Para. A23)\n    1.  The auditor has assessed the risk of material misstatement as low and has obtained sufficient appropriate audit evidence regarding the operating effectiveness of controls relevant to the assertion;\n    2.  The population of items subject to negative confirmation procedures comprises a large number of small, homogeneous, account balances, transactions or conditions;\n    3.  A very low exception rate is expected; and\n    4.  The auditor is not aware of circumstances or conditions that would cause recipients of negative confirmation requests to disregard such requests.\n\n###### Evaluating the Evidence Obtained\n\n1.  The auditor shall evaluate whether the results of the external confirmation procedures provide relevant and reliable audit evidence, or whether further audit evidence is necessary.  \n    (Ref: Para A24-A25)\n\n\\* \\* \\*\n\n##### Application and Other Explanatory Material\n\n###### External Confirmation Procedures\n\nDetermining the Information to Be Confirmed or Requested (Ref: Para. 7(a))\n\n1.  External confirmation procedures frequently are performed to confirm or request information regarding account balances and their elements. They may also be used to confirm terms of agreements, contracts, or transactions between an entity and other parties, or to confirm the absence of certain conditions, such as a “side agreement.”\n\nSelecting the Appropriate Confirming Party (Ref: Para. 7(b))\n\n1.  Responses to confirmation requests provide more relevant and reliable audit evidence when confirmation requests are sent to a confirming party the auditor believes is knowledgeable about the information to be confirmed. For example, a financial institution official who is knowledgeable about the transactions or arrangements for which confirmation is requested may be the most appropriate person at the financial institution from whom to request confirmation.\n\nDesigning Confirmation Requests (Ref: Para. 7(c))\n\n1.  The design of a confirmation request may directly affect the confirmation response rate, and the reliability and the nature of the audit evidence obtained from responses.\n2.  Factors to consider when designing confirmation requests include:\n\n-   The assertions being addressed.\n-   Specific identified risks of material misstatement, including fraud risks.\n-   The layout and presentation of the confirmation request.\n-   Prior experience on the audit or similar engagements.\n-   The method of communication (for example, in paper form, or by electronic or other medium).\n-   Management’s authorisation or encouragement to the confirming parties to respond to the auditor. Confirming parties may only be willing to respond to a confirmation request containing management’s authorisation.\n-   The ability of the intended confirming party to confirm or provide the requested information (for example, individual invoice amount versus total balance).\n\n1.  A positive external confirmation request asks the confirming party to reply to the auditor in all cases, either by indicating the confirming party’s agreement with the given information, or by asking the confirming party to provide information. A response to a positive confirmation request ordinarily is expected to provide reliable audit evidence. There is a risk, however, that a confirming party may reply to the confirmation request without verifying that the information is correct. The auditor may reduce this risk by using positive confirmation requests that do not state the amount (or other information) on the confirmation request, and ask the confirming party to fill in the amount or furnish other information. On the other hand, use of this type of “blank” confirmation request may result in lower response rates because additional effort is required of the confirming parties.\n2.  Determining that requests are properly addressed includes testing the validity of some or all of the addresses on confirmation requests before they are sent out.\n\nFollow-Up on Confirmation Requests (Ref: Para. 7(d))\n\n1.  The auditor may send an additional confirmation request when a reply to a previous request has not been received within a reasonable time. For example, the auditor may, having re-verified the accuracy of the original address, send an additional or follow-up request.\n\n###### Management’s Refusal to Allow the Auditor to Send a Confirmation Request\n\nReasonableness of Management’s Refusal (Ref: Para. 8(a))\n\n1.  A refusal by management to allow the auditor to send a confirmation request is a limitation on the audit evidence the auditor may wish to obtain. The auditor is therefore required to enquire as to the reasons for the limitation. A common reason advanced is the existence of a legal dispute or ongoing negotiation with the intended confirming party, the resolution of which may be affected by an untimely confirmation request. The auditor is required to seek audit evidence as to the validity and reasonableness of the reasons because of the risk that management may be attempting to deny the auditor access to audit evidence that may reveal fraud or error.\n\nImplications for the Assessment of Risks of Material Misstatement (Ref: Para. 8(b))\n\n1.  The auditor may conclude from the evaluation in paragraph 8(b) that it would be appropriate to revise the assessment of the risks of material misstatement at the assertion level and modify planned audit procedures in accordance with ASA 315.[\\[14\\]](#_ftn16) For example, if management’s request to not confirm is unreasonable, this may indicate a fraud risk factor that requires evaluation in accordance with ASA 240.[\\[15\\]](#_ftn17)\n\nAlternative Audit Procedures (Ref: Para. 8(c))\n\n1.  The alternative audit procedures performed may be similar to those appropriate for a non-response as set out in paragraphs A18-A19 of this Auditing Standard. Such procedures also would take account of the results of the auditor’s evaluation in paragraph 8(b) of this Auditing Standard.\n\n###### Results of the External Confirmation Procedures\n\nReliability of Responses to Confirmation Requests (Ref: Para. 10)\n\n1.  ASA 500 indicates that even when audit evidence is obtained from sources external to the entity, circumstances may exist that affect its reliability.[\\[16\\]](#_ftn18) All responses carry some risk of interception, alteration or fraud. Such risk exists regardless of whether a response is obtained in paper form, or by electronic or other medium. Factors that may indicate doubts about the reliability of a response include that it:\n\n-   Was received by the auditor indirectly; or\n-   Appeared not to come from the originally intended confirming party.\n\n1.  Responses received electronically, for example by facsimile or electronic mail, involve risks as to reliability because proof of origin and authority of the respondent may be difficult to establish, and alterations may be difficult to detect. A process used by the auditor and the respondent that creates a secure environment for responses received electronically may mitigate these risks. If the auditor is satisfied that such a process is secure and properly controlled, the reliability of the related responses is enhanced. An electronic confirmation process might incorporate various techniques for validating the identity of a sender of information in electronic form, for example, through the use of encryption, electronic digital signatures, and procedures to verify web site authenticity.\n2.  If a confirming party uses a third party to coordinate and provide responses to confirmation requests, the auditor may perform procedures to address the risks that:\n    1.  The response may not be from the proper source;\n    2.  A respondent may not be authorised to respond; and\n    3.  The integrity of the transmission may have been compromised.\n3.  The auditor is required by ASA 500 to determine whether to modify or add procedures to resolve doubts over the reliability of information to be used as audit evidence.[\\[17\\]](#_ftn19) The auditor may choose to verify the source and contents of a response to a confirmation request by contacting the confirming party. For example, when a confirming party responds by electronic mail, the auditor may telephone the confirming party to determine whether the confirming party did, in fact, send the response. When a response has been returned to the auditor indirectly (for example, because the confirming party incorrectly addressed it to the entity rather than to the auditor), the auditor may request the confirming party to respond in writing directly to the auditor.\n4.  On its own, an oral response to a confirmation request does not meet the definition of an external confirmation because it is not a direct written response to the auditor. However, upon obtaining an oral response to a confirmation request, the auditor may, depending on the circumstances, request the confirming party to respond in writing directly to the auditor. If no such response is received, in accordance with paragraph 12, the auditor seeks other audit evidence to support the information in the oral response.\n5.  A response to a confirmation request may contain restrictive language regarding its use. Such restrictions do not necessarily invalidate the reliability of the response as audit evidence.\n\nUnreliable Responses (Ref: Para. 11)\n\n1.  When the auditor concludes that a response is unreliable, the auditor may need to revise the assessment of the risks of material misstatement at the assertion level and modify planned audit procedures accordingly, in accordance with ASA 315.[\\[18\\]](#_ftn20) For example, an unreliable response may indicate a fraud risk factor that requires evaluation in accordance with ASA 240.[\\[19\\]](#_ftn21)\n\nNon-Responses (Ref: Para. 12)\n\n1.  Examples of alternative audit procedures the auditor may perform include:\n\n-   For accounts receivable balances – examining specific subsequent cash receipts, shipping documentation, and sales near the period-end.\n-   For accounts payable balances – examining subsequent cash disbursements or correspondence from third parties, and other records, such as goods received notes.\n\n1.  The nature and extent of alternative audit procedures are affected by the account and assertion in question. A non-response to a confirmation request may indicate a previously unidentified risk of material misstatement. In such situations, the auditor may need to revise the assessed risk of material misstatement at the assertion level, and modify planned audit procedures, in accordance with ASA 315.[\\[20\\]](#_ftn22) For example, fewer responses to confirmation requests than anticipated, or a greater number of responses than anticipated, may indicate a previously unidentified fraud risk factor that requires evaluation in accordance with ASA 240.[\\[21\\]](#_ftn23)\n\nWhen a Response to a Positive Confirmation Request Is Necessary to Obtain Sufficient Appropriate Audit Evidence (Ref. Para. 13)\n\n1.  In certain circumstances, the auditor may identify an assessed risk of material misstatement at the assertion level for which a response to a positive confirmation request is necessary to obtain sufficient appropriate audit evidence. Such circumstances may include where:\n\n-   The information available to corroborate management’s assertion(s) is only available outside the entity.\n-   Specific fraud risk factors, such as the risk of management override of controls, or the risk of collusion which can involve employee(s) and/or management, prevent the auditor from relying on evidence from the entity.\n\nExceptions (Ref: Para. 14)\n\n1.  Exceptions noted in responses to confirmation requests may indicate misstatements or potential misstatements in the financial statements. When a misstatement is identified, the auditor is required by ASA 240 to evaluate whether such misstatement is indicative of fraud.[\\[22\\]](#_ftn24) Exceptions may provide a guide to the quality of responses from similar confirming parties or for similar accounts. Exceptions also may indicate a deficiency, or deficiencies, in the entity’s internal control over financial reporting.\n2.  Some exceptions do not represent misstatements. For example, the auditor may conclude that differences in responses to confirmation requests are due to timing, measurement, or clerical errors in the external confirmation procedures.\n\n###### Negative Confirmations (Ref: Para. 15)\n\n1.  The failure to receive a response to a negative confirmation request does not explicitly indicate receipt by the intended confirming party of the confirmation request or verification of the accuracy of the information contained in the request. Accordingly, a failure of a confirming party to respond to a negative confirmation request provides significantly less persuasive audit evidence than does a response to a positive confirmation request. Confirming parties also may be more likely to respond indicating their disagreement with a confirmation request when the information in the request is not in their favour, and less likely to respond otherwise. For example, holders of bank deposit accounts may be more likely to respond if they believe that the balance in their account is understated in the confirmation request, but may be less likely to respond when they believe the balance is overstated. Therefore, sending negative confirmation requests to holders of bank deposit accounts may be a useful procedure in considering whether such balances may be understated, but is unlikely to be effective if the auditor is seeking evidence regarding overstatement.\n\n  \n\n###### Evaluating the Evidence Obtained (Ref: Para. 16)\n\n1.  When evaluating the results of individual external confirmation requests, the auditor may categorise such results as follows:\n    1.  A response by the appropriate confirming party indicating agreement with the information provided in the confirmation request, or providing requested information without exception;\n    2.  A response deemed unreliable;\n    3.  A non-response; or\n    4.  A response indicating an exception.\n2.  The auditor’s evaluation, when taken into account with other audit procedures the auditor may have performed, may assist the auditor in concluding whether sufficient appropriate audit evidence has been obtained or whether further audit evidence is necessary, as required by ASA 330.[\\[23\\]](#_ftn25)","sortOrder":11},{"sectionNumber":"Application","sectionType":"section","heading":"Application","content":"##### Application\n\nAus 0.1 This Auditing Standard applies to:\n\n(a) an audit of a financial report for a financial year, or an audit of a financial report for a half-year, in accordance with the Corporations Act 2001; and\n\n(b) an audit of a financial report, or a complete set of financial statements, for any other purpose.\n\nAus 0.2 This Auditing Standard also applies, as appropriate, to an audit of other historical financial information.","sortOrder":12},{"sectionNumber":"Operative Date","sectionType":"section","heading":"Operative Date","content":"##### Operative Date\n\nAus 0.3 This Auditing Standard is operative for financial reporting periods commencing on or after 1 January 2010. \\[Note: For operative dates of paragraphs changed or added by an Amending Standard, see Compilation Details.\\]","sortOrder":13},{"sectionNumber":"Introduction","sectionType":"section","heading":"Introduction","content":"Auditing Standard ASA 505\n\nThe Auditing and Assurance Standards Board (AUASB) made Auditing Standard ASA 505 External Confirmations pursuant to section 227B of the Australian Securities and Investments Commission Act 2001 and section 336 of the Corporations Act 2001, on 27 October 2009.\n\nThis compiled version of ASA 505 incorporates subsequent amendments contained in other Auditing Standards made by the AUASB up to and including 3 March 2020 (see Compilation Details).\n\n## Auditing Standard ASA 505\n\n### External Confirmations\n\n##### Application\n\nAus 0.1 This Auditing Standard applies to:\n\n(a) an audit of a financial report for a financial year, or an audit of a financial report for a half-year, in accordance with the Corporations Act 2001; and\n\n(b) an audit of a financial report, or a complete set of financial statements, for any other purpose.\n\nAus 0.2 This Auditing Standard also applies, as appropriate, to an audit of other historical financial information.\n\n##### Operative Date\n\nAus 0.3 This Auditing Standard is operative for financial reporting periods commencing on or after 1 January 2010. \\[Note: For operative dates of paragraphs changed or added by an Amending Standard, see Compilation Details.\\]\n\n##### Introduction\n\n###### Scope of this Auditing Standard\n\n1.  This Auditing Standard deals with the auditor’s use of external confirmation procedures to obtain audit evidence in accordance with the requirements of ASA 330[\\[1\\]](#_ftn3) and ASA 500[\\[2\\]](#_ftn4). It does not address enquiries regarding litigation and claims, which are dealt with in ASA 502.[\\[3\\]](#_ftn5)\n\n###### External Confirmation Procedures to Obtain Audit Evidence\n\n1.  ASA 500 indicates that the reliability of audit evidence is influenced by its source and by its nature, and is dependent on the individual circumstances under which it is obtained.[\\[4\\]](#_ftn6) That Auditing Standard also includes the following generalisations applicable to audit evidence:[\\[5\\]](#_ftn7)\n\n-   Audit evidence is more reliable when it is obtained from independent sources outside the entity.\n-   Audit evidence obtained directly by the auditor is more reliable than audit evidence obtained indirectly or by inference.\n-   Audit evidence is more reliable when it exists in documentary form, whether paper, electronic or other medium.\n\nAccordingly, depending on the circumstances of the audit, audit evidence in the form of external confirmations received directly by the auditor from confirming parties may be more reliable than evidence generated internally by the entity. This Auditing Standard is intended to assist the auditor in designing and performing external confirmation procedures to obtain relevant and reliable audit evidence.\n\n1.  Other Auditing Standards recognise the importance of external confirmations as audit evidence, for example:\n\n-   ASA 330 discusses the auditor’s responsibility to design and implement overall responses to address the assessed risks of material misstatement at the financial statement level, and to design and perform further audit procedures whose nature, timing and extent are based on, and are responsive to, the assessed risks of material misstatement at the assertion level.[\\[6\\]](#_ftn8) In addition, ASA 330 requires that, irrespective of the assessed risks of material misstatement, the auditor designs and performs substantive procedures for each material class of transactions, account balance, and disclosure. The auditor is also required to consider whether external confirmation procedures are to be performed as substantive audit procedures.[\\[7\\]](#_ftn9)\n-   ASA 330 requires that the auditor obtain more persuasive audit evidence the higher the auditor’s assessment of risk.[\\[8\\]](#_ftn10) To do this, the auditor may increase the quantity of the evidence or obtain evidence that is more relevant or reliable, or both. For example, the auditor may place more emphasis on obtaining evidence directly from third parties or obtaining corroborating evidence from a number of independent sources. ASA 330 also indicates that external confirmation procedures may assist the auditor in obtaining audit evidence with the high level of reliability that the auditor requires to respond to significant risks of material misstatement, whether due to fraud or error.[\\[9\\]](#_ftn11)\n-   ASA 240 indicates that the auditor may design confirmation requests to obtain additional corroborative information as a response to address the assessed risks of material misstatement due to fraud at the assertion level.[\\[10\\]](#_ftn12)\n-   ASA 500 indicates that corroborating information obtained from a source independent of the entity, such as external confirmations, may increase the assurance the auditor obtains from evidence existing within the accounting records or from representations made by management.[\\[11\\]](#_ftn13)\n\n###### Effective Date\n\n1.  \\[Deleted by the AUASB. Refer Aus 0.3\\]\n\n##### Objective\n\n1.  The objective of the auditor, when using external confirmation procedures, is to design and perform such procedures to obtain relevant and reliable audit evidence.\n\n##### Definitions\n\n1.  For purposes of the Australian Auditing Standards, the following terms have the meanings attributed below:\n    1.  External confirmation means audit evidence obtained as a direct written response to the auditor from a third party (the confirming party), in paper form, or by electronic or other medium.\n    2.  Positive confirmation request means a request that the confirming party respond directly to the auditor indicating whether the confirming party agrees or disagrees with the information in the request, or providing the requested information.\n    3.  Negative confirmation request means a request that the confirming party respond directly to the auditor only if the confirming party disagrees with the information provided in the request.\n    4.  Non-response means a failure of the confirming party to respond, or fully respond, to a positive confirmation request, or a confirmation request returned undelivered.\n    5.  Exception means a response that indicates a difference between information requested to be confirmed, or contained in the entity’s records, and information provided by the confirming party.\n\n##### Requirements\n\n###### External Confirmation Procedures\n\n1.  When using external confirmation procedures, the auditor shall maintain control over external confirmation requests, including:\n    1.  Determining the information to be confirmed or requested; (Ref: Para. A1)\n    2.  Selecting the appropriate confirming party; (Ref: Para. A2)\n    3.  Designing the confirmation requests, including determining that requests are properly addressed and contain return information for responses to be sent directly to the auditor; and (Ref: Para. A3-A6)\n    4.  Sending the requests, including follow-up requests when applicable, to the confirming party. (Ref: Para. A7)\n\n###### Management’s Refusal to Allow the Auditor to Send a Confirmation Request\n\n1.  If management refuses to allow the auditor to send a confirmation request, the auditor shall:\n    1.  Enquire as to management’s reasons for the refusal, and seek audit evidence as to their validity and reasonableness; (Ref: Para. A8)\n    2.  Evaluate the implications of management’s refusal on the auditor’s assessment of the relevant risks of material misstatement, including the risk of fraud, and on the nature, timing and extent of other audit procedures; and (Ref: Para. A9)\n    3.  Perform alternative audit procedures designed to obtain relevant and reliable audit evidence. (Ref: Para. A10)\n2.  If the auditor concludes that management’s refusal to allow the auditor to send a confirmation request is unreasonable, or the auditor is unable to obtain relevant and reliable audit evidence from alternative audit procedures, the auditor shall communicate with those charged with governance in accordance with ASA 260.[\\[12\\]](#_ftn14) The auditor also shall determine the implications for the audit and the auditor’s opinion in accordance with ASA 705.[\\[13\\]](#_ftn15)\n\n###### Results of the External Confirmation Procedures\n\nReliability of Responses to Confirmation Requests\n\n1.  If the auditor identifies factors that give rise to doubts about the reliability of the response to a confirmation request, the auditor shall obtain further audit evidence to resolve those doubts.  \n    (Ref: Para. A11-A16)\n2.  If the auditor determines that a response to a confirmation request is not reliable, the auditor shall evaluate the implications on the assessment of the relevant risks of material misstatement, including the risk of fraud, and on the related nature, timing and extent of other audit procedures. (Ref: Para. A17)\n\nNon-Responses\n\n1.  In the case of each non-response, the auditor shall perform alternative audit procedures to obtain relevant and reliable audit evidence. (Ref: Para A18-A19)\n\nWhen a Response to a Positive Confirmation Request Is Necessary to Obtain Sufficient Appropriate Audit Evidence\n\n1.  If the auditor has determined that a response to a positive confirmation request is necessary to obtain sufficient appropriate audit evidence, alternative audit procedures will not provide the audit evidence the auditor requires. If the auditor does not obtain such confirmation, the auditor shall determine the implications for the audit and the auditor’s opinion in accordance with ASA 705. (Ref: Para A20)\n\nExceptions\n\n1.  The auditor shall investigate exceptions to determine whether or not they are indicative of misstatements. (Ref: Para. A21-A22)\n\n###### Negative Confirmations\n\n1.  Negative confirmations provide less persuasive audit evidence than positive confirmations. Accordingly, the auditor shall not use negative confirmation requests as the sole substantive audit procedure to address an assessed risk of material misstatement at the assertion level unless all of the following are present: (Ref: Para. A23)\n    1.  The auditor has assessed the risk of material misstatement as low and has obtained sufficient appropriate audit evidence regarding the operating effectiveness of controls relevant to the assertion;\n    2.  The population of items subject to negative confirmation procedures comprises a large number of small, homogeneous, account balances, transactions or conditions;\n    3.  A very low exception rate is expected; and\n    4.  The auditor is not aware of circumstances or conditions that would cause recipients of negative confirmation requests to disregard such requests.\n\n###### Evaluating the Evidence Obtained\n\n1.  The auditor shall evaluate whether the results of the external confirmation procedures provide relevant and reliable audit evidence, or whether further audit evidence is necessary.  \n    (Ref: Para A24-A25)\n\n\\* \\* \\*\n\n##### Application and Other Explanatory Material\n\n###### External Confirmation Procedures\n\nDetermining the Information to Be Confirmed or Requested (Ref: Para. 7(a))\n\n1.  External confirmation procedures frequently are performed to confirm or request information regarding account balances and their elements. They may also be used to confirm terms of agreements, contracts, or transactions between an entity and other parties, or to confirm the absence of certain conditions, such as a “side agreement.”\n\nSelecting the Appropriate Confirming Party (Ref: Para. 7(b))\n\n1.  Responses to confirmation requests provide more relevant and reliable audit evidence when confirmation requests are sent to a confirming party the auditor believes is knowledgeable about the information to be confirmed. For example, a financial institution official who is knowledgeable about the transactions or arrangements for which confirmation is requested may be the most appropriate person at the financial institution from whom to request confirmation.\n\nDesigning Confirmation Requests (Ref: Para. 7(c))\n\n1.  The design of a confirmation request may directly affect the confirmation response rate, and the reliability and the nature of the audit evidence obtained from responses.\n2.  Factors to consider when designing confirmation requests include:\n\n-   The assertions being addressed.\n-   Specific identified risks of material misstatement, including fraud risks.\n-   The layout and presentation of the confirmation request.\n-   Prior experience on the audit or similar engagements.\n-   The method of communication (for example, in paper form, or by electronic or other medium).\n-   Management’s authorisation or encouragement to the confirming parties to respond to the auditor. Confirming parties may only be willing to respond to a confirmation request containing management’s authorisation.\n-   The ability of the intended confirming party to confirm or provide the requested information (for example, individual invoice amount versus total balance).\n\n1.  A positive external confirmation request asks the confirming party to reply to the auditor in all cases, either by indicating the confirming party’s agreement with the given information, or by asking the confirming party to provide information. A response to a positive confirmation request ordinarily is expected to provide reliable audit evidence. There is a risk, however, that a confirming party may reply to the confirmation request without verifying that the information is correct. The auditor may reduce this risk by using positive confirmation requests that do not state the amount (or other information) on the confirmation request, and ask the confirming party to fill in the amount or furnish other information. On the other hand, use of this type of “blank” confirmation request may result in lower response rates because additional effort is required of the confirming parties.\n2.  Determining that requests are properly addressed includes testing the validity of some or all of the addresses on confirmation requests before they are sent out.\n\nFollow-Up on Confirmation Requests (Ref: Para. 7(d))\n\n1.  The auditor may send an additional confirmation request when a reply to a previous request has not been received within a reasonable time. For example, the auditor may, having re-verified the accuracy of the original address, send an additional or follow-up request.\n\n###### Management’s Refusal to Allow the Auditor to Send a Confirmation Request\n\nReasonableness of Management’s Refusal (Ref: Para. 8(a))\n\n1.  A refusal by management to allow the auditor to send a confirmation request is a limitation on the audit evidence the auditor may wish to obtain. The auditor is therefore required to enquire as to the reasons for the limitation. A common reason advanced is the existence of a legal dispute or ongoing negotiation with the intended confirming party, the resolution of which may be affected by an untimely confirmation request. The auditor is required to seek audit evidence as to the validity and reasonableness of the reasons because of the risk that management may be attempting to deny the auditor access to audit evidence that may reveal fraud or error.\n\nImplications for the Assessment of Risks of Material Misstatement (Ref: Para. 8(b))\n\n1.  The auditor may conclude from the evaluation in paragraph 8(b) that it would be appropriate to revise the assessment of the risks of material misstatement at the assertion level and modify planned audit procedures in accordance with ASA 315.[\\[14\\]](#_ftn16) For example, if management’s request to not confirm is unreasonable, this may indicate a fraud risk factor that requires evaluation in accordance with ASA 240.[\\[15\\]](#_ftn17)\n\nAlternative Audit Procedures (Ref: Para. 8(c))\n\n1.  The alternative audit procedures performed may be similar to those appropriate for a non-response as set out in paragraphs A18-A19 of this Auditing Standard. Such procedures also would take account of the results of the auditor’s evaluation in paragraph 8(b) of this Auditing Standard.\n\n###### Results of the External Confirmation Procedures\n\nReliability of Responses to Confirmation Requests (Ref: Para. 10)\n\n1.  ASA 500 indicates that even when audit evidence is obtained from sources external to the entity, circumstances may exist that affect its reliability.[\\[16\\]](#_ftn18) All responses carry some risk of interception, alteration or fraud. Such risk exists regardless of whether a response is obtained in paper form, or by electronic or other medium. Factors that may indicate doubts about the reliability of a response include that it:\n\n-   Was received by the auditor indirectly; or\n-   Appeared not to come from the originally intended confirming party.\n\n1.  Responses received electronically, for example by facsimile or electronic mail, involve risks as to reliability because proof of origin and authority of the respondent may be difficult to establish, and alterations may be difficult to detect. A process used by the auditor and the respondent that creates a secure environment for responses received electronically may mitigate these risks. If the auditor is satisfied that such a process is secure and properly controlled, the reliability of the related responses is enhanced. An electronic confirmation process might incorporate various techniques for validating the identity of a sender of information in electronic form, for example, through the use of encryption, electronic digital signatures, and procedures to verify web site authenticity.\n2.  If a confirming party uses a third party to coordinate and provide responses to confirmation requests, the auditor may perform procedures to address the risks that:\n    1.  The response may not be from the proper source;\n    2.  A respondent may not be authorised to respond; and\n    3.  The integrity of the transmission may have been compromised.\n3.  The auditor is required by ASA 500 to determine whether to modify or add procedures to resolve doubts over the reliability of information to be used as audit evidence.[\\[17\\]](#_ftn19) The auditor may choose to verify the source and contents of a response to a confirmation request by contacting the confirming party. For example, when a confirming party responds by electronic mail, the auditor may telephone the confirming party to determine whether the confirming party did, in fact, send the response. When a response has been returned to the auditor indirectly (for example, because the confirming party incorrectly addressed it to the entity rather than to the auditor), the auditor may request the confirming party to respond in writing directly to the auditor.\n4.  On its own, an oral response to a confirmation request does not meet the definition of an external confirmation because it is not a direct written response to the auditor. However, upon obtaining an oral response to a confirmation request, the auditor may, depending on the circumstances, request the confirming party to respond in writing directly to the auditor. If no such response is received, in accordance with paragraph 12, the auditor seeks other audit evidence to support the information in the oral response.\n5.  A response to a confirmation request may contain restrictive language regarding its use. Such restrictions do not necessarily invalidate the reliability of the response as audit evidence.\n\nUnreliable Responses (Ref: Para. 11)\n\n1.  When the auditor concludes that a response is unreliable, the auditor may need to revise the assessment of the risks of material misstatement at the assertion level and modify planned audit procedures accordingly, in accordance with ASA 315.[\\[18\\]](#_ftn20) For example, an unreliable response may indicate a fraud risk factor that requires evaluation in accordance with ASA 240.[\\[19\\]](#_ftn21)\n\nNon-Responses (Ref: Para. 12)\n\n1.  Examples of alternative audit procedures the auditor may perform include:\n\n-   For accounts receivable balances – examining specific subsequent cash receipts, shipping documentation, and sales near the period-end.\n-   For accounts payable balances – examining subsequent cash disbursements or correspondence from third parties, and other records, such as goods received notes.\n\n1.  The nature and extent of alternative audit procedures are affected by the account and assertion in question. A non-response to a confirmation request may indicate a previously unidentified risk of material misstatement. In such situations, the auditor may need to revise the assessed risk of material misstatement at the assertion level, and modify planned audit procedures, in accordance with ASA 315.[\\[20\\]](#_ftn22) For example, fewer responses to confirmation requests than anticipated, or a greater number of responses than anticipated, may indicate a previously unidentified fraud risk factor that requires evaluation in accordance with ASA 240.[\\[21\\]](#_ftn23)\n\nWhen a Response to a Positive Confirmation Request Is Necessary to Obtain Sufficient Appropriate Audit Evidence (Ref. Para. 13)\n\n1.  In certain circumstances, the auditor may identify an assessed risk of material misstatement at the assertion level for which a response to a positive confirmation request is necessary to obtain sufficient appropriate audit evidence. Such circumstances may include where:\n\n-   The information available to corroborate management’s assertion(s) is only available outside the entity.\n-   Specific fraud risk factors, such as the risk of management override of controls, or the risk of collusion which can involve employee(s) and/or management, prevent the auditor from relying on evidence from the entity.\n\nExceptions (Ref: Para. 14)\n\n1.  Exceptions noted in responses to confirmation requests may indicate misstatements or potential misstatements in the financial statements. When a misstatement is identified, the auditor is required by ASA 240 to evaluate whether such misstatement is indicative of fraud.[\\[22\\]](#_ftn24) Exceptions may provide a guide to the quality of responses from similar confirming parties or for similar accounts. Exceptions also may indicate a deficiency, or deficiencies, in the entity’s internal control over financial reporting.\n2.  Some exceptions do not represent misstatements. For example, the auditor may conclude that differences in responses to confirmation requests are due to timing, measurement, or clerical errors in the external confirmation procedures.\n\n###### Negative Confirmations (Ref: Para. 15)\n\n1.  The failure to receive a response to a negative confirmation request does not explicitly indicate receipt by the intended confirming party of the confirmation request or verification of the accuracy of the information contained in the request. Accordingly, a failure of a confirming party to respond to a negative confirmation request provides significantly less persuasive audit evidence than does a response to a positive confirmation request. Confirming parties also may be more likely to respond indicating their disagreement with a confirmation request when the information in the request is not in their favour, and less likely to respond otherwise. For example, holders of bank deposit accounts may be more likely to respond if they believe that the balance in their account is understated in the confirmation request, but may be less likely to respond when they believe the balance is overstated. Therefore, sending negative confirmation requests to holders of bank deposit accounts may be a useful procedure in considering whether such balances may be understated, but is unlikely to be effective if the auditor is seeking evidence regarding overstatement.\n\n  \n\n###### Evaluating the Evidence Obtained (Ref: Para. 16)\n\n1.  When evaluating the results of individual external confirmation requests, the auditor may categorise such results as follows:\n    1.  A response by the appropriate confirming party indicating agreement with the information provided in the confirmation request, or providing requested information without exception;\n    2.  A response deemed unreliable;\n    3.  A non-response; or\n    4.  A response indicating an exception.\n2.  The auditor’s evaluation, when taken into account with other audit procedures the auditor may have performed, may assist the auditor in concluding whether sufficient appropriate audit evidence has been obtained or whether further audit evidence is necessary, as required by ASA 330.[\\[23\\]](#_ftn25)","sortOrder":14},{"sectionNumber":"Scope of this Auditing Standard","sectionType":"section","heading":"Scope of this Auditing Standard","content":"###### Scope of this Auditing Standard\n\n1.  This Auditing Standard deals with the auditor’s use of external confirmation procedures to obtain audit evidence in accordance with the requirements of ASA 330[\\[1\\]](#_ftn3) and ASA 500[\\[2\\]](#_ftn4). It does not address enquiries regarding litigation and claims, which are dealt with in ASA 502.[\\[3\\]](#_ftn5)","sortOrder":15},{"sectionNumber":"External Confirmation Procedures to Obta","sectionType":"section","heading":"External Confirmation Procedures to Obtain Audit Evidence","content":"###### External Confirmation Procedures to Obtain Audit Evidence\n\n1.  ASA 500 indicates that the reliability of audit evidence is influenced by its source and by its nature, and is dependent on the individual circumstances under which it is obtained.[\\[4\\]](#_ftn6) That Auditing Standard also includes the following generalisations applicable to audit evidence:[\\[5\\]](#_ftn7)\n\n-   Audit evidence is more reliable when it is obtained from independent sources outside the entity.\n-   Audit evidence obtained directly by the auditor is more reliable than audit evidence obtained indirectly or by inference.\n-   Audit evidence is more reliable when it exists in documentary form, whether paper, electronic or other medium.\n\nAccordingly, depending on the circumstances of the audit, audit evidence in the form of external confirmations received directly by the auditor from confirming parties may be more reliable than evidence generated internally by the entity. This Auditing Standard is intended to assist the auditor in designing and performing external confirmation procedures to obtain relevant and reliable audit evidence.\n\n1.  Other Auditing Standards recognise the importance of external confirmations as audit evidence, for example:\n\n-   ASA 330 discusses the auditor’s responsibility to design and implement overall responses to address the assessed risks of material misstatement at the financial statement level, and to design and perform further audit procedures whose nature, timing and extent are based on, and are responsive to, the assessed risks of material misstatement at the assertion level.[\\[6\\]](#_ftn8) In addition, ASA 330 requires that, irrespective of the assessed risks of material misstatement, the auditor designs and performs substantive procedures for each material class of transactions, account balance, and disclosure. The auditor is also required to consider whether external confirmation procedures are to be performed as substantive audit procedures.[\\[7\\]](#_ftn9)\n-   ASA 330 requires that the auditor obtain more persuasive audit evidence the higher the auditor’s assessment of risk.[\\[8\\]](#_ftn10) To do this, the auditor may increase the quantity of the evidence or obtain evidence that is more relevant or reliable, or both. For example, the auditor may place more emphasis on obtaining evidence directly from third parties or obtaining corroborating evidence from a number of independent sources. ASA 330 also indicates that external confirmation procedures may assist the auditor in obtaining audit evidence with the high level of reliability that the auditor requires to respond to significant risks of material misstatement, whether due to fraud or error.[\\[9\\]](#_ftn11)\n-   ASA 240 indicates that the auditor may design confirmation requests to obtain additional corroborative information as a response to address the assessed risks of material misstatement due to fraud at the assertion level.[\\[10\\]](#_ftn12)\n-   ASA 500 indicates that corroborating information obtained from a source independent of the entity, such as external confirmations, may increase the assurance the auditor obtains from evidence existing within the accounting records or from representations made by management.[\\[11\\]](#_ftn13)","sortOrder":16},{"sectionNumber":"Effective Date","sectionType":"section","heading":"Effective Date","content":"###### Effective Date\n\n1.  \\[Deleted by the AUASB. Refer Aus 0.3\\]","sortOrder":17},{"sectionNumber":"Objective","sectionType":"section","heading":"Objective","content":"##### Objective\n\n1.  The objective of the auditor, when using external confirmation procedures, is to design and perform such procedures to obtain relevant and reliable audit evidence.","sortOrder":18},{"sectionNumber":"Definitions","sectionType":"section","heading":"Definitions","content":"##### Definitions\n\n1.  For purposes of the Australian Auditing Standards, the following terms have the meanings attributed below:\n    1.  External confirmation means audit evidence obtained as a direct written response to the auditor from a third party (the confirming party), in paper form, or by electronic or other medium.\n    2.  Positive confirmation request means a request that the confirming party respond directly to the auditor indicating whether the confirming party agrees or disagrees with the information in the request, or providing the requested information.\n    3.  Negative confirmation request means a request that the confirming party respond directly to the auditor only if the confirming party disagrees with the information provided in the request.\n    4.  Non-response means a failure of the confirming party to respond, or fully respond, to a positive confirmation request, or a confirmation request returned undelivered.\n    5.  Exception means a response that indicates a difference between information requested to be confirmed, or contained in the entity’s records, and information provided by the confirming party.","sortOrder":19},{"sectionNumber":"Requirements","sectionType":"section","heading":"Requirements","content":"Auditing Standard ASA 505\n\nThe Auditing and Assurance Standards Board (AUASB) made Auditing Standard ASA 505 External Confirmations pursuant to section 227B of the Australian Securities and Investments Commission Act 2001 and section 336 of the Corporations Act 2001, on 27 October 2009.\n\nThis compiled version of ASA 505 incorporates subsequent amendments contained in other Auditing Standards made by the AUASB up to and including 3 March 2020 (see Compilation Details).\n\n## Auditing Standard ASA 505\n\n### External Confirmations\n\n##### Application\n\nAus 0.1 This Auditing Standard applies to:\n\n(a) an audit of a financial report for a financial year, or an audit of a financial report for a half-year, in accordance with the Corporations Act 2001; and\n\n(b) an audit of a financial report, or a complete set of financial statements, for any other purpose.\n\nAus 0.2 This Auditing Standard also applies, as appropriate, to an audit of other historical financial information.\n\n##### Operative Date\n\nAus 0.3 This Auditing Standard is operative for financial reporting periods commencing on or after 1 January 2010. \\[Note: For operative dates of paragraphs changed or added by an Amending Standard, see Compilation Details.\\]\n\n##### Introduction\n\n###### Scope of this Auditing Standard\n\n1.  This Auditing Standard deals with the auditor’s use of external confirmation procedures to obtain audit evidence in accordance with the requirements of ASA 330[\\[1\\]](#_ftn3) and ASA 500[\\[2\\]](#_ftn4). It does not address enquiries regarding litigation and claims, which are dealt with in ASA 502.[\\[3\\]](#_ftn5)\n\n###### External Confirmation Procedures to Obtain Audit Evidence\n\n1.  ASA 500 indicates that the reliability of audit evidence is influenced by its source and by its nature, and is dependent on the individual circumstances under which it is obtained.[\\[4\\]](#_ftn6) That Auditing Standard also includes the following generalisations applicable to audit evidence:[\\[5\\]](#_ftn7)\n\n-   Audit evidence is more reliable when it is obtained from independent sources outside the entity.\n-   Audit evidence obtained directly by the auditor is more reliable than audit evidence obtained indirectly or by inference.\n-   Audit evidence is more reliable when it exists in documentary form, whether paper, electronic or other medium.\n\nAccordingly, depending on the circumstances of the audit, audit evidence in the form of external confirmations received directly by the auditor from confirming parties may be more reliable than evidence generated internally by the entity. This Auditing Standard is intended to assist the auditor in designing and performing external confirmation procedures to obtain relevant and reliable audit evidence.\n\n1.  Other Auditing Standards recognise the importance of external confirmations as audit evidence, for example:\n\n-   ASA 330 discusses the auditor’s responsibility to design and implement overall responses to address the assessed risks of material misstatement at the financial statement level, and to design and perform further audit procedures whose nature, timing and extent are based on, and are responsive to, the assessed risks of material misstatement at the assertion level.[\\[6\\]](#_ftn8) In addition, ASA 330 requires that, irrespective of the assessed risks of material misstatement, the auditor designs and performs substantive procedures for each material class of transactions, account balance, and disclosure. The auditor is also required to consider whether external confirmation procedures are to be performed as substantive audit procedures.[\\[7\\]](#_ftn9)\n-   ASA 330 requires that the auditor obtain more persuasive audit evidence the higher the auditor’s assessment of risk.[\\[8\\]](#_ftn10) To do this, the auditor may increase the quantity of the evidence or obtain evidence that is more relevant or reliable, or both. For example, the auditor may place more emphasis on obtaining evidence directly from third parties or obtaining corroborating evidence from a number of independent sources. ASA 330 also indicates that external confirmation procedures may assist the auditor in obtaining audit evidence with the high level of reliability that the auditor requires to respond to significant risks of material misstatement, whether due to fraud or error.[\\[9\\]](#_ftn11)\n-   ASA 240 indicates that the auditor may design confirmation requests to obtain additional corroborative information as a response to address the assessed risks of material misstatement due to fraud at the assertion level.[\\[10\\]](#_ftn12)\n-   ASA 500 indicates that corroborating information obtained from a source independent of the entity, such as external confirmations, may increase the assurance the auditor obtains from evidence existing within the accounting records or from representations made by management.[\\[11\\]](#_ftn13)\n\n###### Effective Date\n\n1.  \\[Deleted by the AUASB. Refer Aus 0.3\\]\n\n##### Objective\n\n1.  The objective of the auditor, when using external confirmation procedures, is to design and perform such procedures to obtain relevant and reliable audit evidence.\n\n##### Definitions\n\n1.  For purposes of the Australian Auditing Standards, the following terms have the meanings attributed below:\n    1.  External confirmation means audit evidence obtained as a direct written response to the auditor from a third party (the confirming party), in paper form, or by electronic or other medium.\n    2.  Positive confirmation request means a request that the confirming party respond directly to the auditor indicating whether the confirming party agrees or disagrees with the information in the request, or providing the requested information.\n    3.  Negative confirmation request means a request that the confirming party respond directly to the auditor only if the confirming party disagrees with the information provided in the request.\n    4.  Non-response means a failure of the confirming party to respond, or fully respond, to a positive confirmation request, or a confirmation request returned undelivered.\n    5.  Exception means a response that indicates a difference between information requested to be confirmed, or contained in the entity’s records, and information provided by the confirming party.\n\n##### Requirements\n\n###### External Confirmation Procedures\n\n1.  When using external confirmation procedures, the auditor shall maintain control over external confirmation requests, including:\n    1.  Determining the information to be confirmed or requested; (Ref: Para. A1)\n    2.  Selecting the appropriate confirming party; (Ref: Para. A2)\n    3.  Designing the confirmation requests, including determining that requests are properly addressed and contain return information for responses to be sent directly to the auditor; and (Ref: Para. A3-A6)\n    4.  Sending the requests, including follow-up requests when applicable, to the confirming party. (Ref: Para. A7)\n\n###### Management’s Refusal to Allow the Auditor to Send a Confirmation Request\n\n1.  If management refuses to allow the auditor to send a confirmation request, the auditor shall:\n    1.  Enquire as to management’s reasons for the refusal, and seek audit evidence as to their validity and reasonableness; (Ref: Para. A8)\n    2.  Evaluate the implications of management’s refusal on the auditor’s assessment of the relevant risks of material misstatement, including the risk of fraud, and on the nature, timing and extent of other audit procedures; and (Ref: Para. A9)\n    3.  Perform alternative audit procedures designed to obtain relevant and reliable audit evidence. (Ref: Para. A10)\n2.  If the auditor concludes that management’s refusal to allow the auditor to send a confirmation request is unreasonable, or the auditor is unable to obtain relevant and reliable audit evidence from alternative audit procedures, the auditor shall communicate with those charged with governance in accordance with ASA 260.[\\[12\\]](#_ftn14) The auditor also shall determine the implications for the audit and the auditor’s opinion in accordance with ASA 705.[\\[13\\]](#_ftn15)\n\n###### Results of the External Confirmation Procedures\n\nReliability of Responses to Confirmation Requests\n\n1.  If the auditor identifies factors that give rise to doubts about the reliability of the response to a confirmation request, the auditor shall obtain further audit evidence to resolve those doubts.  \n    (Ref: Para. A11-A16)\n2.  If the auditor determines that a response to a confirmation request is not reliable, the auditor shall evaluate the implications on the assessment of the relevant risks of material misstatement, including the risk of fraud, and on the related nature, timing and extent of other audit procedures. (Ref: Para. A17)\n\nNon-Responses\n\n1.  In the case of each non-response, the auditor shall perform alternative audit procedures to obtain relevant and reliable audit evidence. (Ref: Para A18-A19)\n\nWhen a Response to a Positive Confirmation Request Is Necessary to Obtain Sufficient Appropriate Audit Evidence\n\n1.  If the auditor has determined that a response to a positive confirmation request is necessary to obtain sufficient appropriate audit evidence, alternative audit procedures will not provide the audit evidence the auditor requires. If the auditor does not obtain such confirmation, the auditor shall determine the implications for the audit and the auditor’s opinion in accordance with ASA 705. (Ref: Para A20)\n\nExceptions\n\n1.  The auditor shall investigate exceptions to determine whether or not they are indicative of misstatements. (Ref: Para. A21-A22)\n\n###### Negative Confirmations\n\n1.  Negative confirmations provide less persuasive audit evidence than positive confirmations. Accordingly, the auditor shall not use negative confirmation requests as the sole substantive audit procedure to address an assessed risk of material misstatement at the assertion level unless all of the following are present: (Ref: Para. A23)\n    1.  The auditor has assessed the risk of material misstatement as low and has obtained sufficient appropriate audit evidence regarding the operating effectiveness of controls relevant to the assertion;\n    2.  The population of items subject to negative confirmation procedures comprises a large number of small, homogeneous, account balances, transactions or conditions;\n    3.  A very low exception rate is expected; and\n    4.  The auditor is not aware of circumstances or conditions that would cause recipients of negative confirmation requests to disregard such requests.\n\n###### Evaluating the Evidence Obtained\n\n1.  The auditor shall evaluate whether the results of the external confirmation procedures provide relevant and reliable audit evidence, or whether further audit evidence is necessary.  \n    (Ref: Para A24-A25)\n\n\\* \\* \\*\n\n##### Application and Other Explanatory Material\n\n###### External Confirmation Procedures\n\nDetermining the Information to Be Confirmed or Requested (Ref: Para. 7(a))\n\n1.  External confirmation procedures frequently are performed to confirm or request information regarding account balances and their elements. They may also be used to confirm terms of agreements, contracts, or transactions between an entity and other parties, or to confirm the absence of certain conditions, such as a “side agreement.”\n\nSelecting the Appropriate Confirming Party (Ref: Para. 7(b))\n\n1.  Responses to confirmation requests provide more relevant and reliable audit evidence when confirmation requests are sent to a confirming party the auditor believes is knowledgeable about the information to be confirmed. For example, a financial institution official who is knowledgeable about the transactions or arrangements for which confirmation is requested may be the most appropriate person at the financial institution from whom to request confirmation.\n\nDesigning Confirmation Requests (Ref: Para. 7(c))\n\n1.  The design of a confirmation request may directly affect the confirmation response rate, and the reliability and the nature of the audit evidence obtained from responses.\n2.  Factors to consider when designing confirmation requests include:\n\n-   The assertions being addressed.\n-   Specific identified risks of material misstatement, including fraud risks.\n-   The layout and presentation of the confirmation request.\n-   Prior experience on the audit or similar engagements.\n-   The method of communication (for example, in paper form, or by electronic or other medium).\n-   Management’s authorisation or encouragement to the confirming parties to respond to the auditor. Confirming parties may only be willing to respond to a confirmation request containing management’s authorisation.\n-   The ability of the intended confirming party to confirm or provide the requested information (for example, individual invoice amount versus total balance).\n\n1.  A positive external confirmation request asks the confirming party to reply to the auditor in all cases, either by indicating the confirming party’s agreement with the given information, or by asking the confirming party to provide information. A response to a positive confirmation request ordinarily is expected to provide reliable audit evidence. There is a risk, however, that a confirming party may reply to the confirmation request without verifying that the information is correct. The auditor may reduce this risk by using positive confirmation requests that do not state the amount (or other information) on the confirmation request, and ask the confirming party to fill in the amount or furnish other information. On the other hand, use of this type of “blank” confirmation request may result in lower response rates because additional effort is required of the confirming parties.\n2.  Determining that requests are properly addressed includes testing the validity of some or all of the addresses on confirmation requests before they are sent out.\n\nFollow-Up on Confirmation Requests (Ref: Para. 7(d))\n\n1.  The auditor may send an additional confirmation request when a reply to a previous request has not been received within a reasonable time. For example, the auditor may, having re-verified the accuracy of the original address, send an additional or follow-up request.\n\n###### Management’s Refusal to Allow the Auditor to Send a Confirmation Request\n\nReasonableness of Management’s Refusal (Ref: Para. 8(a))\n\n1.  A refusal by management to allow the auditor to send a confirmation request is a limitation on the audit evidence the auditor may wish to obtain. The auditor is therefore required to enquire as to the reasons for the limitation. A common reason advanced is the existence of a legal dispute or ongoing negotiation with the intended confirming party, the resolution of which may be affected by an untimely confirmation request. The auditor is required to seek audit evidence as to the validity and reasonableness of the reasons because of the risk that management may be attempting to deny the auditor access to audit evidence that may reveal fraud or error.\n\nImplications for the Assessment of Risks of Material Misstatement (Ref: Para. 8(b))\n\n1.  The auditor may conclude from the evaluation in paragraph 8(b) that it would be appropriate to revise the assessment of the risks of material misstatement at the assertion level and modify planned audit procedures in accordance with ASA 315.[\\[14\\]](#_ftn16) For example, if management’s request to not confirm is unreasonable, this may indicate a fraud risk factor that requires evaluation in accordance with ASA 240.[\\[15\\]](#_ftn17)\n\nAlternative Audit Procedures (Ref: Para. 8(c))\n\n1.  The alternative audit procedures performed may be similar to those appropriate for a non-response as set out in paragraphs A18-A19 of this Auditing Standard. Such procedures also would take account of the results of the auditor’s evaluation in paragraph 8(b) of this Auditing Standard.\n\n###### Results of the External Confirmation Procedures\n\nReliability of Responses to Confirmation Requests (Ref: Para. 10)\n\n1.  ASA 500 indicates that even when audit evidence is obtained from sources external to the entity, circumstances may exist that affect its reliability.[\\[16\\]](#_ftn18) All responses carry some risk of interception, alteration or fraud. Such risk exists regardless of whether a response is obtained in paper form, or by electronic or other medium. Factors that may indicate doubts about the reliability of a response include that it:\n\n-   Was received by the auditor indirectly; or\n-   Appeared not to come from the originally intended confirming party.\n\n1.  Responses received electronically, for example by facsimile or electronic mail, involve risks as to reliability because proof of origin and authority of the respondent may be difficult to establish, and alterations may be difficult to detect. A process used by the auditor and the respondent that creates a secure environment for responses received electronically may mitigate these risks. If the auditor is satisfied that such a process is secure and properly controlled, the reliability of the related responses is enhanced. An electronic confirmation process might incorporate various techniques for validating the identity of a sender of information in electronic form, for example, through the use of encryption, electronic digital signatures, and procedures to verify web site authenticity.\n2.  If a confirming party uses a third party to coordinate and provide responses to confirmation requests, the auditor may perform procedures to address the risks that:\n    1.  The response may not be from the proper source;\n    2.  A respondent may not be authorised to respond; and\n    3.  The integrity of the transmission may have been compromised.\n3.  The auditor is required by ASA 500 to determine whether to modify or add procedures to resolve doubts over the reliability of information to be used as audit evidence.[\\[17\\]](#_ftn19) The auditor may choose to verify the source and contents of a response to a confirmation request by contacting the confirming party. For example, when a confirming party responds by electronic mail, the auditor may telephone the confirming party to determine whether the confirming party did, in fact, send the response. When a response has been returned to the auditor indirectly (for example, because the confirming party incorrectly addressed it to the entity rather than to the auditor), the auditor may request the confirming party to respond in writing directly to the auditor.\n4.  On its own, an oral response to a confirmation request does not meet the definition of an external confirmation because it is not a direct written response to the auditor. However, upon obtaining an oral response to a confirmation request, the auditor may, depending on the circumstances, request the confirming party to respond in writing directly to the auditor. If no such response is received, in accordance with paragraph 12, the auditor seeks other audit evidence to support the information in the oral response.\n5.  A response to a confirmation request may contain restrictive language regarding its use. Such restrictions do not necessarily invalidate the reliability of the response as audit evidence.\n\nUnreliable Responses (Ref: Para. 11)\n\n1.  When the auditor concludes that a response is unreliable, the auditor may need to revise the assessment of the risks of material misstatement at the assertion level and modify planned audit procedures accordingly, in accordance with ASA 315.[\\[18\\]](#_ftn20) For example, an unreliable response may indicate a fraud risk factor that requires evaluation in accordance with ASA 240.[\\[19\\]](#_ftn21)\n\nNon-Responses (Ref: Para. 12)\n\n1.  Examples of alternative audit procedures the auditor may perform include:\n\n-   For accounts receivable balances – examining specific subsequent cash receipts, shipping documentation, and sales near the period-end.\n-   For accounts payable balances – examining subsequent cash disbursements or correspondence from third parties, and other records, such as goods received notes.\n\n1.  The nature and extent of alternative audit procedures are affected by the account and assertion in question. A non-response to a confirmation request may indicate a previously unidentified risk of material misstatement. In such situations, the auditor may need to revise the assessed risk of material misstatement at the assertion level, and modify planned audit procedures, in accordance with ASA 315.[\\[20\\]](#_ftn22) For example, fewer responses to confirmation requests than anticipated, or a greater number of responses than anticipated, may indicate a previously unidentified fraud risk factor that requires evaluation in accordance with ASA 240.[\\[21\\]](#_ftn23)\n\nWhen a Response to a Positive Confirmation Request Is Necessary to Obtain Sufficient Appropriate Audit Evidence (Ref. Para. 13)\n\n1.  In certain circumstances, the auditor may identify an assessed risk of material misstatement at the assertion level for which a response to a positive confirmation request is necessary to obtain sufficient appropriate audit evidence. Such circumstances may include where:\n\n-   The information available to corroborate management’s assertion(s) is only available outside the entity.\n-   Specific fraud risk factors, such as the risk of management override of controls, or the risk of collusion which can involve employee(s) and/or management, prevent the auditor from relying on evidence from the entity.\n\nExceptions (Ref: Para. 14)\n\n1.  Exceptions noted in responses to confirmation requests may indicate misstatements or potential misstatements in the financial statements. When a misstatement is identified, the auditor is required by ASA 240 to evaluate whether such misstatement is indicative of fraud.[\\[22\\]](#_ftn24) Exceptions may provide a guide to the quality of responses from similar confirming parties or for similar accounts. Exceptions also may indicate a deficiency, or deficiencies, in the entity’s internal control over financial reporting.\n2.  Some exceptions do not represent misstatements. For example, the auditor may conclude that differences in responses to confirmation requests are due to timing, measurement, or clerical errors in the external confirmation procedures.\n\n###### Negative Confirmations (Ref: Para. 15)\n\n1.  The failure to receive a response to a negative confirmation request does not explicitly indicate receipt by the intended confirming party of the confirmation request or verification of the accuracy of the information contained in the request. Accordingly, a failure of a confirming party to respond to a negative confirmation request provides significantly less persuasive audit evidence than does a response to a positive confirmation request. Confirming parties also may be more likely to respond indicating their disagreement with a confirmation request when the information in the request is not in their favour, and less likely to respond otherwise. For example, holders of bank deposit accounts may be more likely to respond if they believe that the balance in their account is understated in the confirmation request, but may be less likely to respond when they believe the balance is overstated. Therefore, sending negative confirmation requests to holders of bank deposit accounts may be a useful procedure in considering whether such balances may be understated, but is unlikely to be effective if the auditor is seeking evidence regarding overstatement.\n\n  \n\n###### Evaluating the Evidence Obtained (Ref: Para. 16)\n\n1.  When evaluating the results of individual external confirmation requests, the auditor may categorise such results as follows:\n    1.  A response by the appropriate confirming party indicating agreement with the information provided in the confirmation request, or providing requested information without exception;\n    2.  A response deemed unreliable;\n    3.  A non-response; or\n    4.  A response indicating an exception.\n2.  The auditor’s evaluation, when taken into account with other audit procedures the auditor may have performed, may assist the auditor in concluding whether sufficient appropriate audit evidence has been obtained or whether further audit evidence is necessary, as required by ASA 330.[\\[23\\]](#_ftn25)","sortOrder":20},{"sectionNumber":"External Confirmation Procedures","sectionType":"section","heading":"External Confirmation Procedures","content":"###### External Confirmation Procedures\n\n1.  When using external confirmation procedures, the auditor shall maintain control over external confirmation requests, including:\n    1.  Determining the information to be confirmed or requested; (Ref: Para. A1)\n    2.  Selecting the appropriate confirming party; (Ref: Para. A2)\n    3.  Designing the confirmation requests, including determining that requests are properly addressed and contain return information for responses to be sent directly to the auditor; and (Ref: Para. A3-A6)\n    4.  Sending the requests, including follow-up requests when applicable, to the confirming party. (Ref: Para. A7)","sortOrder":21},{"sectionNumber":"Management’s Refusal to Allow the Audito","sectionType":"section","heading":"Management’s Refusal to Allow the Auditor to Send a Confirmation Request","content":"###### Management’s Refusal to Allow the Auditor to Send a Confirmation Request\n\n1.  If management refuses to allow the auditor to send a confirmation request, the auditor shall:\n    1.  Enquire as to management’s reasons for the refusal, and seek audit evidence as to their validity and reasonableness; (Ref: Para. A8)\n    2.  Evaluate the implications of management’s refusal on the auditor’s assessment of the relevant risks of material misstatement, including the risk of fraud, and on the nature, timing and extent of other audit procedures; and (Ref: Para. A9)\n    3.  Perform alternative audit procedures designed to obtain relevant and reliable audit evidence. (Ref: Para. A10)\n2.  If the auditor concludes that management’s refusal to allow the auditor to send a confirmation request is unreasonable, or the auditor is unable to obtain relevant and reliable audit evidence from alternative audit procedures, the auditor shall communicate with those charged with governance in accordance with ASA 260.[\\[12\\]](#_ftn14) The auditor also shall determine the implications for the audit and the auditor’s opinion in accordance with ASA 705.[\\[13\\]](#_ftn15)","sortOrder":22},{"sectionNumber":"Results of the External Confirmation Pro","sectionType":"section","heading":"Results of the External Confirmation Procedures","content":"###### Results of the External Confirmation Procedures\n\nReliability of Responses to Confirmation Requests\n\n1.  If the auditor identifies factors that give rise to doubts about the reliability of the response to a confirmation request, the auditor shall obtain further audit evidence to resolve those doubts.  \n    (Ref: Para. A11-A16)\n2.  If the auditor determines that a response to a confirmation request is not reliable, the auditor shall evaluate the implications on the assessment of the relevant risks of material misstatement, including the risk of fraud, and on the related nature, timing and extent of other audit procedures. (Ref: Para. A17)\n\nNon-Responses\n\n1.  In the case of each non-response, the auditor shall perform alternative audit procedures to obtain relevant and reliable audit evidence. (Ref: Para A18-A19)\n\nWhen a Response to a Positive Confirmation Request Is Necessary to Obtain Sufficient Appropriate Audit Evidence\n\n1.  If the auditor has determined that a response to a positive confirmation request is necessary to obtain sufficient appropriate audit evidence, alternative audit procedures will not provide the audit evidence the auditor requires. If the auditor does not obtain such confirmation, the auditor shall determine the implications for the audit and the auditor’s opinion in accordance with ASA 705. (Ref: Para A20)\n\nExceptions\n\n1.  The auditor shall investigate exceptions to determine whether or not they are indicative of misstatements. (Ref: Para. A21-A22)","sortOrder":23},{"sectionNumber":"Negative Confirmations","sectionType":"section","heading":"Negative Confirmations","content":"###### Negative Confirmations\n\n1.  Negative confirmations provide less persuasive audit evidence than positive confirmations. Accordingly, the auditor shall not use negative confirmation requests as the sole substantive audit procedure to address an assessed risk of material misstatement at the assertion level unless all of the following are present: (Ref: Para. A23)\n    1.  The auditor has assessed the risk of material misstatement as low and has obtained sufficient appropriate audit evidence regarding the operating effectiveness of controls relevant to the assertion;\n    2.  The population of items subject to negative confirmation procedures comprises a large number of small, homogeneous, account balances, transactions or conditions;\n    3.  A very low exception rate is expected; and\n    4.  The auditor is not aware of circumstances or conditions that would cause recipients of negative confirmation requests to disregard such requests.","sortOrder":24},{"sectionNumber":"Evaluating the Evidence Obtained","sectionType":"section","heading":"Evaluating the Evidence Obtained","content":"###### Evaluating the Evidence Obtained\n\n1.  The auditor shall evaluate whether the results of the external confirmation procedures provide relevant and reliable audit evidence, or whether further audit evidence is necessary.  \n    (Ref: Para A24-A25)\n\n\\* \\* \\*","sortOrder":25},{"sectionNumber":"Application and Other Explanatory Materi","sectionType":"section","heading":"Application and Other Explanatory Material","content":"Auditing Standard ASA 505\n\nThe Auditing and Assurance Standards Board (AUASB) made Auditing Standard ASA 505 External Confirmations pursuant to section 227B of the Australian Securities and Investments Commission Act 2001 and section 336 of the Corporations Act 2001, on 27 October 2009.\n\nThis compiled version of ASA 505 incorporates subsequent amendments contained in other Auditing Standards made by the AUASB up to and including 3 March 2020 (see Compilation Details).\n\n## Auditing Standard ASA 505\n\n### External Confirmations\n\n##### Application\n\nAus 0.1 This Auditing Standard applies to:\n\n(a) an audit of a financial report for a financial year, or an audit of a financial report for a half-year, in accordance with the Corporations Act 2001; and\n\n(b) an audit of a financial report, or a complete set of financial statements, for any other purpose.\n\nAus 0.2 This Auditing Standard also applies, as appropriate, to an audit of other historical financial information.\n\n##### Operative Date\n\nAus 0.3 This Auditing Standard is operative for financial reporting periods commencing on or after 1 January 2010. \\[Note: For operative dates of paragraphs changed or added by an Amending Standard, see Compilation Details.\\]\n\n##### Introduction\n\n###### Scope of this Auditing Standard\n\n1.  This Auditing Standard deals with the auditor’s use of external confirmation procedures to obtain audit evidence in accordance with the requirements of ASA 330[\\[1\\]](#_ftn3) and ASA 500[\\[2\\]](#_ftn4). It does not address enquiries regarding litigation and claims, which are dealt with in ASA 502.[\\[3\\]](#_ftn5)\n\n###### External Confirmation Procedures to Obtain Audit Evidence\n\n1.  ASA 500 indicates that the reliability of audit evidence is influenced by its source and by its nature, and is dependent on the individual circumstances under which it is obtained.[\\[4\\]](#_ftn6) That Auditing Standard also includes the following generalisations applicable to audit evidence:[\\[5\\]](#_ftn7)\n\n-   Audit evidence is more reliable when it is obtained from independent sources outside the entity.\n-   Audit evidence obtained directly by the auditor is more reliable than audit evidence obtained indirectly or by inference.\n-   Audit evidence is more reliable when it exists in documentary form, whether paper, electronic or other medium.\n\nAccordingly, depending on the circumstances of the audit, audit evidence in the form of external confirmations received directly by the auditor from confirming parties may be more reliable than evidence generated internally by the entity. This Auditing Standard is intended to assist the auditor in designing and performing external confirmation procedures to obtain relevant and reliable audit evidence.\n\n1.  Other Auditing Standards recognise the importance of external confirmations as audit evidence, for example:\n\n-   ASA 330 discusses the auditor’s responsibility to design and implement overall responses to address the assessed risks of material misstatement at the financial statement level, and to design and perform further audit procedures whose nature, timing and extent are based on, and are responsive to, the assessed risks of material misstatement at the assertion level.[\\[6\\]](#_ftn8) In addition, ASA 330 requires that, irrespective of the assessed risks of material misstatement, the auditor designs and performs substantive procedures for each material class of transactions, account balance, and disclosure. The auditor is also required to consider whether external confirmation procedures are to be performed as substantive audit procedures.[\\[7\\]](#_ftn9)\n-   ASA 330 requires that the auditor obtain more persuasive audit evidence the higher the auditor’s assessment of risk.[\\[8\\]](#_ftn10) To do this, the auditor may increase the quantity of the evidence or obtain evidence that is more relevant or reliable, or both. For example, the auditor may place more emphasis on obtaining evidence directly from third parties or obtaining corroborating evidence from a number of independent sources. ASA 330 also indicates that external confirmation procedures may assist the auditor in obtaining audit evidence with the high level of reliability that the auditor requires to respond to significant risks of material misstatement, whether due to fraud or error.[\\[9\\]](#_ftn11)\n-   ASA 240 indicates that the auditor may design confirmation requests to obtain additional corroborative information as a response to address the assessed risks of material misstatement due to fraud at the assertion level.[\\[10\\]](#_ftn12)\n-   ASA 500 indicates that corroborating information obtained from a source independent of the entity, such as external confirmations, may increase the assurance the auditor obtains from evidence existing within the accounting records or from representations made by management.[\\[11\\]](#_ftn13)\n\n###### Effective Date\n\n1.  \\[Deleted by the AUASB. Refer Aus 0.3\\]\n\n##### Objective\n\n1.  The objective of the auditor, when using external confirmation procedures, is to design and perform such procedures to obtain relevant and reliable audit evidence.\n\n##### Definitions\n\n1.  For purposes of the Australian Auditing Standards, the following terms have the meanings attributed below:\n    1.  External confirmation means audit evidence obtained as a direct written response to the auditor from a third party (the confirming party), in paper form, or by electronic or other medium.\n    2.  Positive confirmation request means a request that the confirming party respond directly to the auditor indicating whether the confirming party agrees or disagrees with the information in the request, or providing the requested information.\n    3.  Negative confirmation request means a request that the confirming party respond directly to the auditor only if the confirming party disagrees with the information provided in the request.\n    4.  Non-response means a failure of the confirming party to respond, or fully respond, to a positive confirmation request, or a confirmation request returned undelivered.\n    5.  Exception means a response that indicates a difference between information requested to be confirmed, or contained in the entity’s records, and information provided by the confirming party.\n\n##### Requirements\n\n###### External Confirmation Procedures\n\n1.  When using external confirmation procedures, the auditor shall maintain control over external confirmation requests, including:\n    1.  Determining the information to be confirmed or requested; (Ref: Para. A1)\n    2.  Selecting the appropriate confirming party; (Ref: Para. A2)\n    3.  Designing the confirmation requests, including determining that requests are properly addressed and contain return information for responses to be sent directly to the auditor; and (Ref: Para. A3-A6)\n    4.  Sending the requests, including follow-up requests when applicable, to the confirming party. (Ref: Para. A7)\n\n###### Management’s Refusal to Allow the Auditor to Send a Confirmation Request\n\n1.  If management refuses to allow the auditor to send a confirmation request, the auditor shall:\n    1.  Enquire as to management’s reasons for the refusal, and seek audit evidence as to their validity and reasonableness; (Ref: Para. A8)\n    2.  Evaluate the implications of management’s refusal on the auditor’s assessment of the relevant risks of material misstatement, including the risk of fraud, and on the nature, timing and extent of other audit procedures; and (Ref: Para. A9)\n    3.  Perform alternative audit procedures designed to obtain relevant and reliable audit evidence. (Ref: Para. A10)\n2.  If the auditor concludes that management’s refusal to allow the auditor to send a confirmation request is unreasonable, or the auditor is unable to obtain relevant and reliable audit evidence from alternative audit procedures, the auditor shall communicate with those charged with governance in accordance with ASA 260.[\\[12\\]](#_ftn14) The auditor also shall determine the implications for the audit and the auditor’s opinion in accordance with ASA 705.[\\[13\\]](#_ftn15)\n\n###### Results of the External Confirmation Procedures\n\nReliability of Responses to Confirmation Requests\n\n1.  If the auditor identifies factors that give rise to doubts about the reliability of the response to a confirmation request, the auditor shall obtain further audit evidence to resolve those doubts.  \n    (Ref: Para. A11-A16)\n2.  If the auditor determines that a response to a confirmation request is not reliable, the auditor shall evaluate the implications on the assessment of the relevant risks of material misstatement, including the risk of fraud, and on the related nature, timing and extent of other audit procedures. (Ref: Para. A17)\n\nNon-Responses\n\n1.  In the case of each non-response, the auditor shall perform alternative audit procedures to obtain relevant and reliable audit evidence. (Ref: Para A18-A19)\n\nWhen a Response to a Positive Confirmation Request Is Necessary to Obtain Sufficient Appropriate Audit Evidence\n\n1.  If the auditor has determined that a response to a positive confirmation request is necessary to obtain sufficient appropriate audit evidence, alternative audit procedures will not provide the audit evidence the auditor requires. If the auditor does not obtain such confirmation, the auditor shall determine the implications for the audit and the auditor’s opinion in accordance with ASA 705. (Ref: Para A20)\n\nExceptions\n\n1.  The auditor shall investigate exceptions to determine whether or not they are indicative of misstatements. (Ref: Para. A21-A22)\n\n###### Negative Confirmations\n\n1.  Negative confirmations provide less persuasive audit evidence than positive confirmations. Accordingly, the auditor shall not use negative confirmation requests as the sole substantive audit procedure to address an assessed risk of material misstatement at the assertion level unless all of the following are present: (Ref: Para. A23)\n    1.  The auditor has assessed the risk of material misstatement as low and has obtained sufficient appropriate audit evidence regarding the operating effectiveness of controls relevant to the assertion;\n    2.  The population of items subject to negative confirmation procedures comprises a large number of small, homogeneous, account balances, transactions or conditions;\n    3.  A very low exception rate is expected; and\n    4.  The auditor is not aware of circumstances or conditions that would cause recipients of negative confirmation requests to disregard such requests.\n\n###### Evaluating the Evidence Obtained\n\n1.  The auditor shall evaluate whether the results of the external confirmation procedures provide relevant and reliable audit evidence, or whether further audit evidence is necessary.  \n    (Ref: Para A24-A25)\n\n\\* \\* \\*\n\n##### Application and Other Explanatory Material\n\n###### External Confirmation Procedures\n\nDetermining the Information to Be Confirmed or Requested (Ref: Para. 7(a))\n\n1.  External confirmation procedures frequently are performed to confirm or request information regarding account balances and their elements. They may also be used to confirm terms of agreements, contracts, or transactions between an entity and other parties, or to confirm the absence of certain conditions, such as a “side agreement.”\n\nSelecting the Appropriate Confirming Party (Ref: Para. 7(b))\n\n1.  Responses to confirmation requests provide more relevant and reliable audit evidence when confirmation requests are sent to a confirming party the auditor believes is knowledgeable about the information to be confirmed. For example, a financial institution official who is knowledgeable about the transactions or arrangements for which confirmation is requested may be the most appropriate person at the financial institution from whom to request confirmation.\n\nDesigning Confirmation Requests (Ref: Para. 7(c))\n\n1.  The design of a confirmation request may directly affect the confirmation response rate, and the reliability and the nature of the audit evidence obtained from responses.\n2.  Factors to consider when designing confirmation requests include:\n\n-   The assertions being addressed.\n-   Specific identified risks of material misstatement, including fraud risks.\n-   The layout and presentation of the confirmation request.\n-   Prior experience on the audit or similar engagements.\n-   The method of communication (for example, in paper form, or by electronic or other medium).\n-   Management’s authorisation or encouragement to the confirming parties to respond to the auditor. Confirming parties may only be willing to respond to a confirmation request containing management’s authorisation.\n-   The ability of the intended confirming party to confirm or provide the requested information (for example, individual invoice amount versus total balance).\n\n1.  A positive external confirmation request asks the confirming party to reply to the auditor in all cases, either by indicating the confirming party’s agreement with the given information, or by asking the confirming party to provide information. A response to a positive confirmation request ordinarily is expected to provide reliable audit evidence. There is a risk, however, that a confirming party may reply to the confirmation request without verifying that the information is correct. The auditor may reduce this risk by using positive confirmation requests that do not state the amount (or other information) on the confirmation request, and ask the confirming party to fill in the amount or furnish other information. On the other hand, use of this type of “blank” confirmation request may result in lower response rates because additional effort is required of the confirming parties.\n2.  Determining that requests are properly addressed includes testing the validity of some or all of the addresses on confirmation requests before they are sent out.\n\nFollow-Up on Confirmation Requests (Ref: Para. 7(d))\n\n1.  The auditor may send an additional confirmation request when a reply to a previous request has not been received within a reasonable time. For example, the auditor may, having re-verified the accuracy of the original address, send an additional or follow-up request.\n\n###### Management’s Refusal to Allow the Auditor to Send a Confirmation Request\n\nReasonableness of Management’s Refusal (Ref: Para. 8(a))\n\n1.  A refusal by management to allow the auditor to send a confirmation request is a limitation on the audit evidence the auditor may wish to obtain. The auditor is therefore required to enquire as to the reasons for the limitation. A common reason advanced is the existence of a legal dispute or ongoing negotiation with the intended confirming party, the resolution of which may be affected by an untimely confirmation request. The auditor is required to seek audit evidence as to the validity and reasonableness of the reasons because of the risk that management may be attempting to deny the auditor access to audit evidence that may reveal fraud or error.\n\nImplications for the Assessment of Risks of Material Misstatement (Ref: Para. 8(b))\n\n1.  The auditor may conclude from the evaluation in paragraph 8(b) that it would be appropriate to revise the assessment of the risks of material misstatement at the assertion level and modify planned audit procedures in accordance with ASA 315.[\\[14\\]](#_ftn16) For example, if management’s request to not confirm is unreasonable, this may indicate a fraud risk factor that requires evaluation in accordance with ASA 240.[\\[15\\]](#_ftn17)\n\nAlternative Audit Procedures (Ref: Para. 8(c))\n\n1.  The alternative audit procedures performed may be similar to those appropriate for a non-response as set out in paragraphs A18-A19 of this Auditing Standard. Such procedures also would take account of the results of the auditor’s evaluation in paragraph 8(b) of this Auditing Standard.\n\n###### Results of the External Confirmation Procedures\n\nReliability of Responses to Confirmation Requests (Ref: Para. 10)\n\n1.  ASA 500 indicates that even when audit evidence is obtained from sources external to the entity, circumstances may exist that affect its reliability.[\\[16\\]](#_ftn18) All responses carry some risk of interception, alteration or fraud. Such risk exists regardless of whether a response is obtained in paper form, or by electronic or other medium. Factors that may indicate doubts about the reliability of a response include that it:\n\n-   Was received by the auditor indirectly; or\n-   Appeared not to come from the originally intended confirming party.\n\n1.  Responses received electronically, for example by facsimile or electronic mail, involve risks as to reliability because proof of origin and authority of the respondent may be difficult to establish, and alterations may be difficult to detect. A process used by the auditor and the respondent that creates a secure environment for responses received electronically may mitigate these risks. If the auditor is satisfied that such a process is secure and properly controlled, the reliability of the related responses is enhanced. An electronic confirmation process might incorporate various techniques for validating the identity of a sender of information in electronic form, for example, through the use of encryption, electronic digital signatures, and procedures to verify web site authenticity.\n2.  If a confirming party uses a third party to coordinate and provide responses to confirmation requests, the auditor may perform procedures to address the risks that:\n    1.  The response may not be from the proper source;\n    2.  A respondent may not be authorised to respond; and\n    3.  The integrity of the transmission may have been compromised.\n3.  The auditor is required by ASA 500 to determine whether to modify or add procedures to resolve doubts over the reliability of information to be used as audit evidence.[\\[17\\]](#_ftn19) The auditor may choose to verify the source and contents of a response to a confirmation request by contacting the confirming party. For example, when a confirming party responds by electronic mail, the auditor may telephone the confirming party to determine whether the confirming party did, in fact, send the response. When a response has been returned to the auditor indirectly (for example, because the confirming party incorrectly addressed it to the entity rather than to the auditor), the auditor may request the confirming party to respond in writing directly to the auditor.\n4.  On its own, an oral response to a confirmation request does not meet the definition of an external confirmation because it is not a direct written response to the auditor. However, upon obtaining an oral response to a confirmation request, the auditor may, depending on the circumstances, request the confirming party to respond in writing directly to the auditor. If no such response is received, in accordance with paragraph 12, the auditor seeks other audit evidence to support the information in the oral response.\n5.  A response to a confirmation request may contain restrictive language regarding its use. Such restrictions do not necessarily invalidate the reliability of the response as audit evidence.\n\nUnreliable Responses (Ref: Para. 11)\n\n1.  When the auditor concludes that a response is unreliable, the auditor may need to revise the assessment of the risks of material misstatement at the assertion level and modify planned audit procedures accordingly, in accordance with ASA 315.[\\[18\\]](#_ftn20) For example, an unreliable response may indicate a fraud risk factor that requires evaluation in accordance with ASA 240.[\\[19\\]](#_ftn21)\n\nNon-Responses (Ref: Para. 12)\n\n1.  Examples of alternative audit procedures the auditor may perform include:\n\n-   For accounts receivable balances – examining specific subsequent cash receipts, shipping documentation, and sales near the period-end.\n-   For accounts payable balances – examining subsequent cash disbursements or correspondence from third parties, and other records, such as goods received notes.\n\n1.  The nature and extent of alternative audit procedures are affected by the account and assertion in question. A non-response to a confirmation request may indicate a previously unidentified risk of material misstatement. In such situations, the auditor may need to revise the assessed risk of material misstatement at the assertion level, and modify planned audit procedures, in accordance with ASA 315.[\\[20\\]](#_ftn22) For example, fewer responses to confirmation requests than anticipated, or a greater number of responses than anticipated, may indicate a previously unidentified fraud risk factor that requires evaluation in accordance with ASA 240.[\\[21\\]](#_ftn23)\n\nWhen a Response to a Positive Confirmation Request Is Necessary to Obtain Sufficient Appropriate Audit Evidence (Ref. Para. 13)\n\n1.  In certain circumstances, the auditor may identify an assessed risk of material misstatement at the assertion level for which a response to a positive confirmation request is necessary to obtain sufficient appropriate audit evidence. Such circumstances may include where:\n\n-   The information available to corroborate management’s assertion(s) is only available outside the entity.\n-   Specific fraud risk factors, such as the risk of management override of controls, or the risk of collusion which can involve employee(s) and/or management, prevent the auditor from relying on evidence from the entity.\n\nExceptions (Ref: Para. 14)\n\n1.  Exceptions noted in responses to confirmation requests may indicate misstatements or potential misstatements in the financial statements. When a misstatement is identified, the auditor is required by ASA 240 to evaluate whether such misstatement is indicative of fraud.[\\[22\\]](#_ftn24) Exceptions may provide a guide to the quality of responses from similar confirming parties or for similar accounts. Exceptions also may indicate a deficiency, or deficiencies, in the entity’s internal control over financial reporting.\n2.  Some exceptions do not represent misstatements. For example, the auditor may conclude that differences in responses to confirmation requests are due to timing, measurement, or clerical errors in the external confirmation procedures.\n\n###### Negative Confirmations (Ref: Para. 15)\n\n1.  The failure to receive a response to a negative confirmation request does not explicitly indicate receipt by the intended confirming party of the confirmation request or verification of the accuracy of the information contained in the request. Accordingly, a failure of a confirming party to respond to a negative confirmation request provides significantly less persuasive audit evidence than does a response to a positive confirmation request. Confirming parties also may be more likely to respond indicating their disagreement with a confirmation request when the information in the request is not in their favour, and less likely to respond otherwise. For example, holders of bank deposit accounts may be more likely to respond if they believe that the balance in their account is understated in the confirmation request, but may be less likely to respond when they believe the balance is overstated. Therefore, sending negative confirmation requests to holders of bank deposit accounts may be a useful procedure in considering whether such balances may be understated, but is unlikely to be effective if the auditor is seeking evidence regarding overstatement.\n\n  \n\n###### Evaluating the Evidence Obtained (Ref: Para. 16)\n\n1.  When evaluating the results of individual external confirmation requests, the auditor may categorise such results as follows:\n    1.  A response by the appropriate confirming party indicating agreement with the information provided in the confirmation request, or providing requested information without exception;\n    2.  A response deemed unreliable;\n    3.  A non-response; or\n    4.  A response indicating an exception.\n2.  The auditor’s evaluation, when taken into account with other audit procedures the auditor may have performed, may assist the auditor in concluding whether sufficient appropriate audit evidence has been obtained or whether further audit evidence is necessary, as required by ASA 330.[\\[23\\]](#_ftn25)","sortOrder":26},{"sectionNumber":"Negative Confirmations (Ref: Para. 15)","sectionType":"section","heading":"Negative Confirmations (Ref: Para. 15)","content":"###### Negative Confirmations (Ref: Para. 15)\n\n1.  The failure to receive a response to a negative confirmation request does not explicitly indicate receipt by the intended confirming party of the confirmation request or verification of the accuracy of the information contained in the request. Accordingly, a failure of a confirming party to respond to a negative confirmation request provides significantly less persuasive audit evidence than does a response to a positive confirmation request. Confirming parties also may be more likely to respond indicating their disagreement with a confirmation request when the information in the request is not in their favour, and less likely to respond otherwise. For example, holders of bank deposit accounts may be more likely to respond if they believe that the balance in their account is understated in the confirmation request, but may be less likely to respond when they believe the balance is overstated. Therefore, sending negative confirmation requests to holders of bank deposit accounts may be a useful procedure in considering whether such balances may be understated, but is unlikely to be effective if the auditor is seeking evidence regarding overstatement.","sortOrder":30},{"sectionNumber":"Evaluating the Evidence Obtained (Ref: P","sectionType":"section","heading":"Evaluating the Evidence Obtained (Ref: Para. 16)","content":"###### Evaluating the Evidence Obtained (Ref: Para. 16)\n\n1.  When evaluating the results of individual external confirmation requests, the auditor may categorise such results as follows:\n    1.  A response by the appropriate confirming party indicating agreement with the information provided in the confirmation request, or providing requested information without exception;\n    2.  A response deemed unreliable;\n    3.  A non-response; or\n    4.  A response indicating an exception.\n2.  The auditor’s evaluation, when taken into account with other audit procedures the auditor may have performed, may assist the auditor in concluding whether sufficient appropriate audit evidence has been obtained or whether further audit evidence is necessary, as required by ASA 330.[\\[23\\]](#_ftn25)","sortOrder":31}],"analysis":{"flash_summary":{"complexity_score":4,"scope_assessment":{"changed":false,"description":"This compilation aligns ASA 505 with the equivalent International Standard on Auditing (ISA 505) while including Australian‑specific paragraphs (marked \"Aus\") and later amendments up to March 2020. The core subject—use of external confirmations by auditors—remains the same. The compilation clarifies application to Australian audits under the Corporations Act and adds explanatory material and procedural detail, but it does not materially expand the substantive scope beyond the original purpose of guiding auditors on external confirmations (see Aus 0.1 and Authority Statement)."},"complexity_factors":["Compilation incorporating multiple amending standards (amendments up to 3 Mar 2020) and Aus‑prefixed paragraphs (Aus 0.1–0.3)","Repeated cross‑references to other AUASB standards (ASA 330, ASA 500, ASA 240, ASA 260, ASA 705, ASA 315) increasing interpretive dependency","Five defined terms in the Definitions section (External confirmation; positive/negative confirmation; non‑response; exception)","Procedural branching for different outcomes (reliable response; unreliable response; non‑response; exception) across paras. 10–14 and A11–A22","A four‑point conditional test for relying solely on negative confirmations (para. 15 / A23)","Extensive application and explanatory material (Application and A1–A25) that expands operational detail beyond terse requirements","Multiple operative‑date and footnote edits across the compilation table that add administrative complexity"],"plain_english_summary":"**What this standard does, in plain English**\n\n- ASA 505 sets out how auditors should use external confirmations as part of an audit. External confirmations are written replies the auditor receives directly from a third party (for example, a bank, customer or supplier) that confirm information held by the entity being audited (Definitions, para. 6).\n\n- The standard requires the auditor to control the confirmation process end-to-end: decide what to confirm, choose who to ask, design the request so replies go back to the auditor, send the requests and follow up when necessary (Requirements, para. 7; Application A1–A7).\n\n- It distinguishes positive confirmations (reply required in all cases) from negative confirmations (reply only if the third party disagrees) and sets rules about when each is acceptable. Negative confirmations may only be relied on as the sole substantive test if a four-part test is met (para. 15; A23).\n\n- If management refuses to let the auditor send confirmation requests the auditor must ask why, test the validity of the reasons, revise risk assessments if needed, carry out alternative procedures, and, where refusal is unreasonable or alternatives are insufficient, inform those charged with governance and consider the effect on the audit opinion (para. 8–9; A8–A10).\n\n- The auditor must treat responses carefully: check whether a response is genuine and reliable, follow up or obtain other evidence if responses are incomplete or suspect, investigate exceptions (differences between the entity’s records and third‑party replies), and perform alternative procedures for non‑responses (paras. 10–14; A11–A22).\n\n- The standard is applicable to audits of financial reports (under the Corporations Act) and other audits of financial statements or historical financial information (Aus 0.1–0.2).\n\n**Who this affects**\n\n- Auditors and audit firms: they must design and execute confirmation procedures, document judgments, and escalate where evidence is limited or management obstructs confirmations (paras. 7–9, 13).\n- Entities being audited and their management: they must cooperate (or justify refusal) and may face additional audit work if they limit confirmations (para. 8).\n- Confirming parties (banks, customers, suppliers, third‑party service providers): they receive requests and may need to provide written replies; they bear the operational cost of responding (A2, A3).\n- Those charged with governance (boards, audit committees): they may receive communications if management unreasonably restricts confirmations (para. 9).\n\n**Why it matters (mechanically)**\n\n- External confirmations are treated as higher‑quality evidence when they come directly to the auditor from an independent party (Intro; ASA 500 references). The standard explains when confirmations are necessary to obtain sufficient appropriate audit evidence, and what auditors must do if confirmations are missing, unreliable or withheld (paras. 1, 10–13).\n\n**Official purpose-claims (and how they play against costs and incentives)**\n\n- Official claim: confirmations increase the reliability of audit evidence because they come from independent third parties and are obtained directly by the auditor (Intro; ASA 500 references). That is a factual mechanism: independent, direct documentary evidence can be more persuasive than internal records.\n\n- Costs and incentives: complying with the standard increases audit time and administrative cost (designing requests, sending follow-ups, validating electronic replies). Confirming parties incur small-to-moderate costs to respond. Management may have an incentive to impede confirmations when evidence could be unfavourable; the standard makes auditors investigate refusals and escalate where necessary (para. 8–9, A8–A10), which raises the cost of concealment but also increases audit effort and potential conflict.\n\n- Trade-offs and opportunity cost: relying on confirmations typically reduces the need for alternative, possibly more expensive procedures (e.g. wide-scale inspection of subsequent cash receipts), but obtaining good confirmations (especially secure electronic replies) can itself be resource‑intensive. The standard lets auditors substitute alternative procedures where confirmations aren’t available, but requires them to assess whether those alternatives provide equivalent reliability (paras. 12–13, A18–A20).\n\n- Implementation risks and compliance burden: auditors must judge reliability of electronic replies (risk of interception or spoofing) and may need extra procedures (telephone verification, secure channels) to validate origin (A11–A16). Firms must maintain procedures and documentation to show compliance, which is a modest regulatory/compliance burden.\n\n- Effects on private choice and market activity: the standard does not prescribe specific service providers or technologies. It does, however, increase demand for secure confirmation channels, and creates an operational interaction between auditors and third parties (banks, debtors, creditors), which can shift some administrative burden onto those third parties (A11–A16).\n\n**Who pays, who decides, and what behaviour changes**\n\n- Who pays: audit firms and their clients primarily bear the direct cost of performing confirmations (time, postage, secure electronic systems); confirming third parties incur the cost of preparing replies.\n- Who decides: the auditor decides whether to use confirmations, who to contact, how to design requests, and whether alternative procedures suffice; management can attempt to limit requests but must justify refusals, which the auditor tests (paras. 7–9).\n- Behaviour changes: auditors will set up controls and follow-up routines for confirmations; management may either cooperate to avoid escalation or, if obstructive, trigger further audit work and governance reporting; confirming parties may adopt secure electronic processes if auditors require enhanced assurance (A11–A16).\n\n**Key sections to read for action**\n\n- Applicability: Aus 0.1–0.3\n- Core requirements (design and control of confirmations): para. 7 and Application A1–A7\n- Management refusal and escalation: paras. 8–9 and A8–A10\n- Handling responses, non‑responses and exceptions: paras. 10–14 and A11–A22\n- Negative confirmations test: para. 15 and A23\n- Evaluation of sufficiency of evidence: para. 16 and A24–A25\n\n"},"flash_summary_failed":{"failed":true,"reason":"A positive credit balance is required for all requests, including BYOK, so fallback providers remain available. Add credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up to continue.","source":"analysis-cron"},"kimi_summary":{"_metrics":{"completionTokens":591},"content_quality":"ok","complexity_score":6,"scope_assessment":{"changed":false,"description":"The scope remains focused on external confirmation procedures for audit evidence. While the standard has been amended twice (2018 and 2020), these changes appear limited to footnote updates and minor technical adjustments rather than expansion beyond the original purpose of governing how auditors obtain and evaluate third-party confirmations."},"complexity_factors":["Multiple cross-references to other auditing standards (ASA 330, ASA 500, ASA 240, ASA 502, ASA 260, ASA 705, ASA 315)","Conditional requirements with nested exceptions (e.g., negative confirmations can only be used as sole procedure if four specific conditions are all met)","Defined terms section with 5 technical definitions that constrain interpretation throughout","Extensive application guidance (A1-A25) that elaborates on but does not replace mandatory requirements","Multiple scenarios requiring professional judgment (reliability assessment, management refusal, non-responses, exceptions)","Compilation structure showing amendments across three separate standards over 11 years"],"plain_english_summary":"This standard requires auditors to use external confirmations—direct written replies from third parties—to verify information in financial records, prescribing how and when to obtain them, maintain control over the process, and assess response reliability. It distinguishes stronger positive confirmations from weaker negative ones, directs follow‑up on non‑responses or discrepancies, and sets steps if management blocks access. Because confirmations are independent evidence, the rules help detect errors or fraud and support audit opinions."}},"importantCases":[],"_links":{"self":"/api/acts/asa-505-external-confirmations-october-2009","history":"/api/acts/asa-505-external-confirmations-october-2009/history","analysis":"/api/acts/asa-505-external-confirmations-october-2009/analysis","conflicts":"/api/acts/asa-505-external-confirmations-october-2009/conflicts","importantCases":"/api/acts/asa-505-external-confirmations-october-2009/important-cases","documents":"/api/acts/asa-505-external-confirmations-october-2009/documents"}}