Auditing: A Journal of Practice & Theory
Vol. 27, No. 2
November 2008
pp. 253–279
American Accounting Association
DOI: 10.2308/aud.2008.27.2.253
A Summary of Research and Enforcement
Release Evidence on Confirmation Use
and Effectiveness
Paul Caster, Randal J. Elder, and Diane J. Janvrin
SUMMARY: Confirmations are extensively used and are often perceived by practitioners to be one of the most persuasive forms of audit evidence. Yet academic research
has found limitations that restrict confirmation effectiveness for many management assertions. In addition, a number of problems with false and forged confirmations are
identified in Accounting and Auditing Enforcement Releases 共AAERs兲. The Public Company Accounting Oversight Board 共PCAOB兲 and the International Auditing and Assurance Standards Board 共IAASB兲 have put confirmation evidence on their respective
agendas. Academic research indicates that receivable confirmations can be effective
evidence for the existence assertion. Low response rates, as well as respondent errors
and directional bias in detecting errors, are key barriers to confirmation effectiveness.
Our review of AAERs identified failure to authenticate responses, collusion between
auditee management and customers, and concealed side agreements and special
terms as specific problem areas. We also identify a number of research questions for
future research.
Keywords: audit confirmations; audit evidence; confirmation reliability; AAER evidence.
Data Availability: Please contact the authors.
INTRODUCTION
Confirmations are considered to be among the most persuasive forms of audit evidence,
because they are received directly from a third party. Accounts receivable confirmations have been
required in most circumstances since 1939, and because auditors perceive them to be persuasive
evidence for many assertions, they also use them for other accounts, including cash, debt, marketable securities, and other account balances, even though their use is not required by auditing
standards. However, academic studies have questioned the reliability of confirmations, Securities
Paul Caster is an Associate Professor at Fairfield University, Randal J. Elder is a Professor at Syracuse
University, and Diane J. Janvrin is an Assistant Professor at Iowa State University.
We thank the editor, Dan Simunic, and two anonymous reviewers for their helpful comments. We also appreciate the
comments of Doug Carmichael. We thank Dana Hermanson for providing data on AAERs, and Nicole Bogler, Andrew
Crocco, Sarah Erdman, and Ahmed Abdel Meguid for research assistance. The views in this paper are those of the authors
and do not represent an official position of the American Accounting Association.
Submitted: January 2007
Accepted: May 2008
Published Online: March 2009
253
254
Caster, Elder, and Janvrin
and Exchange Commission 共SEC兲 investigations have uncovered problems with confirmation
evidence, including forgeries and other fraud, and new communication technologies allow auditors
to obtain evidence directly from third parties without direct written communication.
To address these and other issues, the PCAOB currently is engaged in a project on the use of
confirmations in financial statement audits.1 In addition, the IAASB has put confirmation evidence
on its agenda. In a Standing Advisory Group 共SAG兲 briefing paper, PCAOB staff identified 13
questions regarding the required use of confirmations, confirmation effectiveness and reliability,
confirmation of special terms and agreements, confirmation of information other than accounts
receivable, use of negative confirmations, and requests not to confirm 共PCAOB 2004b兲. This study
provides a synthesis of academic and practitioner research on confirmation use and effectiveness.
In addition, original research using AAER evidence was conducted to supplement the research
synthesis.
We conducted a search for academic literature relevant to each area of inquiry. A fairly
extensive, although somewhat dated, literature exists on accounts receivable confirmation effectiveness and reliability. Limited academic research addresses many of the other research questions
in the PCAOB SAG briefing paper. This lack of academic research is partially due to the narrow
focus of some of the PCAOB questions, but also reflects a lack of available data on auditor
confirmation decisions. As a result, we expanded our inquiry to include relevant practitioner
literature 共for example, professional journals and AICPA guides兲. We also examined AAERs as
they have been used in studies related to fraudulent financial reporting 共Dechow et al. 1996;
Bonner et al. 1998兲, and many financial reporting frauds involve revenue recognition issues
共Beasley et al. 1999兲 that may be related to the use of accounts receivable confirmations. Our
primary findings are:
共1兲 Currently, some auditors choose not to confirm accounts receivable without justifying
how they met one or more of the criteria in Statement on Auditing Standards 共SAS兲 No.
67 共AICPA 1991兲 for not confirming the accounts.
共2兲 Generally, confirmations are relatively effective in testing the existence assertion for
accounts receivable. However, low response rates have a negative impact on confirmation
effectiveness.
共3兲 Anecdotal evidence and some research suggest confirmation response rates are declining.
Research has identified several methods to improve response rates.
共4兲 Confirmations are also somewhat effective in examining the valuation assertion for accounts receivable. However, confirmees fail to detect many seeded errors in controlled
experiments and are more likely to detect and report errors that are unfavorable to the
confirmee rather than favorable errors.
共5兲 Collusion between auditee management and the confirmee was a problem area in receivables confirmations identified from AAERs. The relationship between management and
the confirmee calls into question the perception by auditors of confirmees as “independent” third parties.
1
To facilitate the development of auditing standards and to inform regulators of insights from the academic auditing
literature, the Auditing Section of the American Accounting Association 共AAA兲 is developing a series of literature
syntheses for the PCAOB 共e.g., Allen et al. 2006兲. This paper is a literature synthesis prepared under this program.
Additional information about the Research Synthesis Program is available on the Auditing Section website at: http://
aaahq.org/audit/index.htm. The views expressed in this paper are those of the authors and do not reflect an official
position of the AAA or its Auditing Section. In addition, while discussions with the PCAOB staff helped us identify the
issues that are most relevant to setting auditing standards, the author team was not selected or managed by the PCAOB,
and the resulting paper expresses our views, which may or may not correspond to views held by the PCAOB and their
staff.
Auditing: A Journal of Practice & Theory
American Accounting Association
November 2008
A Summary of Research and Enforcement Release Evidence on Confirmation Use and Effectiveness
255
共6兲 Fictitious responses provided by auditee management were a problem area identified
from a review of AAERs for accounts receivable and cash balance confirmations. Current
auditing standards do not require auditors to authenticate responses.
共7兲 Enforcement actions described in the AAERs indicated problems with bank
confirmations.2 With the exception of accounts receivable, U.S. auditing standards related
to confirmations do not provide explicit guidance for specific accounts, such as cash,
marketable securities or other account balances, as well as confirmation of special terms
or side agreements.
共8兲 Considerable evidence exists that electronic confirmations and other forms of electronic
database queries 共i.e., defined views of supplier and/or customer databases兲 are becoming
more prevalent. Technology offers alternatives to standard paper confirmations that may
provide for authentication and improve confirmation effectiveness 共Aldhizer and Cashell
2006兲.
Our study provides new insights into the confirmation process and the reliability of third party
confirmations. Practitioners may be placing unwarranted reliance on confirmations because the
evidence is provided by “independent” third parties, but collusion between auditee management
and the confirmees, found in a number of AAERs, suggests that confirmees may not be “independent” third parties. After all, they do have a customer/supplier relationship with the auditee.
Practitioners and regulators alike need to reassess the degree of persuasiveness afforded by third
party confirmations in light of these findings.
In addition, our review and synthesis of the academic literature found that most confirmation
studies focused almost exclusively on accounts receivable confirmations and they were designed
primarily to examine issues of reliability and response rates, where reliability is defined in terms
of detection of errors. Our study highlights several avenues for future academic research, including research into confirmation evidence for account balances other than accounts receivable, as
well as research into the effects of new technologies for electronic responses to confirmation
requests. Further, academic research may also examine the issue of the degree of persuasiveness
afforded by third party confirmations.
The next section briefly describes our research method. The following section provides a
summary of the findings from the review of research and enforcement releases. The final section
presents our summary and conclusions.
METHOD
We conducted a review of the academic literature on confirmations. We found few current
papers examining confirmations. Most prior research addressed the effectiveness of confirmation
of accounts receivable. To provide additional evidence relevant to questions in the SAG briefing
paper involving confirmation of other accounts, we reviewed AAERs and practitioner literature.3
We identified 113 confirmation-related AAERs involving 51 auditees. Interestingly, most AAERs
dealt with accounts receivable confirmation problems.
2
3
The Auditing Standards Board developed a standard bank confirmation form and suggestions for its use; however, SAS
No. 67 does not require bank confirmations 共AICPA 1991兲.
AAERs are available at the SEC’s Enforcement Division website and on Commerce Clearing House’s Accounting
Research Manager database and cover the period 1982 through 2006.
Auditing: A Journal of Practice & Theory
November 2008
American Accounting Association
256
Caster, Elder, and Janvrin
RELEVANT FINDINGS FROM RESEARCH AND ENFORCEMENT RELEASES
Use of Confirmations
In response to the large-scale fraud at the McKesson-Robbins Corporation, the accounting
profession issued Statement on Auditing Procedures 共SAP兲 Number 1, Extensions of Auditing
Procedure, in 1939. Before SAP No. 1, confirmation of receivables was not widely used except in
the brokerage and banking industries 共Peloubet 1939兲. McKesson-Robbins created a fictitious
subsidiary with fictitious customers and inventory; thus, SAP No. 1 recommended confirmation of
accounts receivable “wherever practicable and reasonable” 共American Institute of Accountants
1939兲.4 The first discussion question addresses the effectiveness of confirmations in addressing
management assertions.
DQ1: Are confirmations an effective source of evidence for auditors in substantiating management’s assertions in the financial statements? If yes, to what extent should confirmations be used during an audit?
SAS No. 67 notes that confirmations, if properly designed, may address any one or more of
management’s assertions.5 The standard also notes that confirmations do not address all assertions
equally well. For example, SAS No. 67 notes that accounts receivable confirmations are likely to
be more effective at addressing the existence assertion than the completeness and valuation assertions.
Evidence from Accounts Receivable Confirmation Studies
Existence Assertion. The McKesson-Robbins case highlights the perceived importance of
accounts receivable confirmations as evidence in support of the existence assertion. The subsequent requirements for the use of accounts receivable confirmations were issued based on the
belief that if the McKesson-Robbins auditors had sent confirmation requests, they likely would
have discovered the fictitious accounts receivable.
Ashton and Hylas 共1980兲 indirectly examined the reliability of accounts receivable evidence
in support of the existence assertion. They sent 600 confirmation requests, of which 200 requests
were sent to fictitious companies at fictitious addresses. The United States Post Office returned all
200 letters as “undeliverable.” Thus, in similar fraud situations, accounts receivable confirmation
requests may detect fictitious accounts, assuming no change has occurred in the effectiveness of
postal services. However, if management provides valid mailing addresses that are controlled by
management, mailing of confirmations will not detect the fictitious customers unless the auditor
performs extended procedures to validate the existence of the customer.
For the existence assertion, accounts receivable confirmations are probably the best source of
evidence, because the evidence is obtained from sources outside of the auditee. Alternative types
of evidence, such as sales invoices or bills of lading, are not as persuasive because they are
internal documents produced by auditee management. Even with confirmation requirements, accounts receivable frauds continue to occur similar to McKesson-Robbins, such as Equity Funding,
or more recent examples such as Royal Ahold 共AAER No. 2124, 2004兲.6 It is an open question as
to the extent confirmation requirements inhibit such fraud.
4
5
6
The accounting profession subsequently revised the confirmation standards. The standard currently in effect is SAS No.
67 共AICPA 1991兲.
SAS No. 67 specifically refers to the five management assertions in SAS No. 31 共AICPA 1980兲 —existence or occurrence, completeness, rights and obligations, valuation or allocation, and presentation and disclosure. SAS No. 106
共AICPA 2006a兲 replaced SAS No. 31 and is applicable for audits of nonpublic entities.
Many cases cited involve multiple AAERs. In these cases, we cite the most relevant AAER.
Auditing: A Journal of Practice & Theory
American Accounting Association
November 2008
A Summary of Research and Enforcement Release Evidence on Confirmation Use and Effectiveness
257
Valuation and Other Assertions. Prior academic literature on accounts receivable
confirmations has focused on the reliability of the evidence in support of the valuation assertion,
although anecdotal evidence supports the use of confirmations as a secondary source of evidence
for the completeness assertion. Studies by Davis et al. 共1967兲, Sauls 共1970, 1972兲, Warren 共1974兲,
Sorkin 共1978兲, Armitage 共1990兲, Caster 共1990兲, and Engle and Hunton 共2001兲 addressed the ability
of confirmees to detect and report errors seeded into accounts receivable. In general, these studies
found that confirmees fail to report a large percentage of seeded errors, and the evidence tends to
be biased such that confirmees are more likely to report errors that are unfavorable to the confirmee.
Confirmation Effectiveness
The effectiveness of the confirmation process must also be considered. Several studies examined one aspect of effectiveness, confirmation response rates. In a field experiment conducted at a
large retailer, Ashton and Hylas 共1981b兲 examined seven different techniques designed to increase
confirmation response rates. They found that attention-getting techniques used in survey research,
such as the type of postage used and pre-notification by postcard, enhanced confirmation response
rates. Also, stamping the envelope with “confirmation enclosed” increased response rates. Other
techniques were less successful, although personally signed requests and requests that included
balance details increased response rates slightly.
Bailey and Ballard 共1986兲 tested four techniques to increase response rates. They found that
three techniques—using a first class stamp on the reply envelope, enclosing a token gift 共a pen兲,
and sending a follow-up reminder letter—enhanced response rates. The fourth technique, a rubber
stamp reading “important—please respond” was not effective. File and Ward 共1995兲 found that
response rates to second confirmation requests can be increased by printing the requests on the
auditor’s letterhead instead of on the auditee’s letterhead. Engle 共1991兲 and Engle and Hunton
共2001兲 found that small monetary incentives helped increase response rates. However, Engle and
Hunton 共2001兲 also found that detection rates of seeded errors were lower for groups given small
monetary incentives.
Krogstad and Romney 共1980兲 conducted a field experiment to test the effectiveness of confirming individual invoices included in year-end accounts receivable rather than the entire yearend account balance. They found that invoice confirmations improved confirmation reliability and
effectiveness. Response rates were significantly higher and fewer exceptions were noted as compared to traditional account balance confirmation requests. However, Ashton and Hylas 共1981a兲
also conducted an experiment on invoice and balance confirmation requests, and their results
favored balance confirmations. In addition, Allen and Elder 共2001兲 did not report any increase in
response rates for invoice confirmation requests over balance confirmation requests when examining workpapers for audits of 53 medium-sized companies; the sample included three large
accounting firms. They also found that fewer errors were detected by invoice confirmations.
Swearingen et al. 共1991兲 used a field study to examine confirmation effectiveness based on the
type of confirmation respondent. Accounts payable clerks 共presumably with some accounting
training兲 reported a greater number of errors with greater magnitude than individual consumer
respondents 共presumably with little to no accounting training兲. However, individual
consumers were better than accountants at detecting certain types of errors, such as unrecorded
collections and unrecorded returns and allowances.
Evidence from SEC AAERs
Our review of AAERs revealed several instances of collusion between auditee management
and their customers that limited the effectiveness of confirmations. For example, in the Digital
Lava case 共AAER-1807, 2003兲, management persuaded their customers to sign and return false
Auditing: A Journal of Practice & Theory
November 2008
American Accounting Association
258
Caster, Elder, and Janvrin
confirmations. In Suprema 共AAER-1938, 2004兲, auditee management even paid the customer for
the false confirmations. Collusion between auditee personnel and their customers was the most
prevalent pitfall found in our review of AAERs. In other cases such as Quintus 共AAER-1560,
2002兲, auditee personnel were able to forge signatures or otherwise provide auditors with false
receivable confirmations. These cases call into question the reliability of confirmation evidence
and the perception that confirmation evidence is more persuasive because it comes from “independent” third parties.
Some cases highlighted that confirmation evidence can be effective in determining existence
and supporting valuation when collusion is not involved. For example, AAER-1295 共2000兲, involving Boston Scientific, specifically noted that the accounts receivable fraud was detected by the
accounts receivable confirmations. In other cases such as California Micro Devices 共AAER-1823,
2003兲, the confirmation process worked; however, the auditors failed to follow up on confirmation
exceptions.
Summary of Question 1
Confirmation effectiveness varies depending upon which management assertion is involved.
Academic research suggests that confirmations provide effective evidence to support the accounts
receivable existence assertion. However, the effectiveness of confirmations is limited by nonresponses, and anecdotal evidence suggests that response rates may have declined over time.7
Further, a review of AAERs found a significant number of cases involving collusion and also
forged and false confirmations, suggesting that confirmation evidence may not be as persuasive as
it is generally perceived.8
Findings from academic research indicate confirmations are somewhat less effective in supporting the valuation assertion. Although many errors are reported to auditors on confirmation
forms, confirmees fail to detect and report a significant percentage of seeded errors. Moreover, the
procedure produces biased results in that confirmees are more likely to report errors that overstate
accounts receivable rather than understate the balance.
Table 1 provides a summary of response and detection rates for selected receivable confirmation studies. Early studies in Panel A indicate very high response rates, while later studies indicate
significantly lower response rates. This could reflect a decreased willingness of confirmees to
respond, or it may represent a lack of auditor effort in obtaining responses through second and
third requests. These studies pre-date the Sarbanes-Oxley Act. Public companies may be less
willing to respond to confirmation requests to avoid any potential legal responsibility under the
Act for failure to detect misstatements 共Aldhizer and Cashell 2006兲. Further, Panel B does not
indicate that invoice confirmations result in higher responses. Invoice and balance confirmations
are significantly different, but little evidence exists on the extent of use of invoice
confirmations and their relative effectiveness.
Confirmation Pitfalls
DQ2: Are there any pitfalls the auditors should be aware of in using confirmations?
Pitfalls Identified in Practitioner Literature. The pitfalls Carmichael 共1991兲 identified when
the AICPA Auditing Standards Board was considering SAS No. 67 are still relevant today.
7
8
Although it is widely believed that response rates have declined, this has not been examined in any controlled longitudinal study. Elder and Allen 共2005兲 reported a decline in response rates of approximately 6 percent between 1994 and
1999 based on a field study of 53 companies in 1994 and 41 companies in 1999.
An IAASB issues paper 共IFAC 2006兲 also notes that the presumption that confirmations may provide reliable evidence
may be overstated, and that auditors may not be well suited to identify when a response is not reliable.
Auditing: A Journal of Practice & Theory
American Accounting Association
November 2008
A Summary of Research and Enforcement Release Evidence on Confirmation Use and Effectiveness
259
TABLE 1
Confirmation Response and Detection Rates for Selected Studies
Panel A: Response Ratesa
Study
Davis et al.
共1967兲
Hubbard and
Bullington 共1972兲
Sauls 共1970兲
Armitage 共1990兲
Caster 共1990兲
Engle 共1991兲
Engle and Hunton
共2001兲
Allen and Elder
共2001兲
Elder and Allen
共2005兲
Type of
Entity
Bank—demand
deposit accounts
Heating oil
distributor
Credit union—time
deposits:
Standard
Blank form
Midwestern
manufacturer
Steel distribution
company
Bank—installment
and commercial
loans
4 newspaper
organizations
53 manufacturers
or distributors
41 manufacturers
or distributors
Sample
Size
Positive
First
Request
Positive
Second
Request
Positive
Total
Response
150
68%
21%
89%
34
44%
35%
79%
100
100
50
80%
62%
52%
16%
16%
28%
96%
78%
80%
331
NA
NA
68%
40
43%
40%
83%
800
47%
NA
47%
1149
NA
NA
49%b
683
NA
NA
43%b
Panel B: Response Rates for Balance versus Invoice Confirmations
Type of
Balance
Invoice
Study
Entity
Confirmations Confirmations
Krogstad and
Romney
共1980兲
Ashton and Hylas
共1981a兲
Allen and Elder
共2001兲
Elder and Allen
共2005兲
Manufacturing
conglomerate
47%
60%
Large chemical
manufacturer—
commercial customers
53 manufacturers or
distributors
41 manufacturers or
distributors
72%
64%
59%
43%
55%
37%
(continued on next page)
Auditing: A Journal of Practice & Theory
November 2008
American Accounting Association
260
Caster, Elder, and Janvrin
TABLE 1 (continued)
Panel C: Confirmation Detection Rates for Selected Studies
Positive
Confirmationsc
Study
Davis et al.
共1967兲
Hubbard and
Bullington 共1972兲
Sauls 共1970兲
Sauls 共1972兲
Warren 共1974兲
Sorkin 共1978兲
Armitage 共1990兲
Caster 共1990兲
Type of
Entity
Bank—demand
deposit accounts
Heating oil
distributor
Credit union—
time deposits
Bank—personal
and automobile
loan accounts
Credit union—
loan balances
Bank—loan
balances
Midwestern
manufacturer
Steel distribution
company
Gross
Detection
Negative
Net Detection
Confirmations
59%
64%
44%
48%
54%
40%
76%
83%
NAd
43%
100%
NAd
21%
32%
18%
35%
45%
18%
38%
49%
16%
47%
76%
NAd
a
Only studies or portions of studies that did not involve seeded errors or incentives are reported since seeded errors and
incentives may impact response rates.
b
Study involves field data and is a blend of invoice and balance confirmations. While it is illustrative of response rates
actually achieved, these response rates may not represent achievable rates since extent of use of second requests is
unknown.
c
The gross detection rate is the number of errors detected divided by the number of confirmations sent. The net detection
rate is the number of errors detected divided by the number of confirmations received.
d
Negative confirmations were not used.
NA = not available.
Carmichael raised concerns about the auditor’s responsibility to verify the identity of the
confirmation respondent. In many confirmation frauds, such as the Equity Funding case, auditee
personnel simply signed confirmation requests themselves.
Carmichael 共1991兲 also raised the issue of confirmation responses received by telephone or
fax. He cautioned that with nontraditional 共i.e., nonpaper-based兲 confirmation responses, individuals with intent to commit fraud can fairly easily deceive auditors through intercepting and altering
the confirmation request. Today, electronic mail can be added to this list of nontraditional confirmation responses. Thus, confirmation respondent authentication is an important issue with both
traditional and nontraditional forms of confirmation response.
Another pitfall Carmichael 共1991兲 discussed occurs when the confirmee is not independent of
the auditee. This will occur in related party transactions and may require auditors to go beyond the
confirmation process to seek satisfactory evidence.
Auditing: A Journal of Practice & Theory
American Accounting Association
November 2008
A Summary of Research and Enforcement Release Evidence on Confirmation Use and Effectiveness
261
McConnell and Banks 共1998兲 highlighted additional pitfalls in the confirmation process,
based on problems identified in the AICPA’s peer review program.9 Pitfalls identified generally
involved auditors’ apparent lack of understanding of the guidance contained in SAS No. 67, such
as when confirmations do not need to be sent, when it is appropriate to send positive or negative
confirmation requests, how to properly project errors from a sample of accounts to the population,
and when to apply or not apply alternative procedures. In addition, they also raised the issue of
nontraditional forms of confirmation responses.
Pitfalls Identified in Academic Literature. As noted earlier, the primary pitfalls identified in
academic literature include the overall problem with declining response rates, the inability of
respondents to identify seeded errors, and the tendency for respondents to accounts receivable
confirmations to identify more errors that overstate rather than understate the accounts
receivable balance.10
Pitfalls Identified from a Review of SEC AAERs. We identified several pitfalls from reviewing SEC AAERs as summarized in Table 2. Twenty-five of the cases, representing over 40
percent of the auditees, involve collusion between management and/or employees and their customers. Auditee management persuaded one or more of its customers to provide the auditors with
false information, such as failing to admit to side agreements that permitted the right of return or
represented sales on consignment, or simply agreeing to sign and confirm a balance that was
clearly incorrect. Ten of these cases included concealed side agreements, and another 15 involved
false confirmations without side agreements. These cases are most problematic for auditors, because direct correspondence with third parties is considered to have a high degree of persuasiveness. However, when third parties collude with auditees, detection of the fraud is much more
difficult.
In ten cases, auditee management provided confirmations with forged signatures to the auditors. For example, a Quintus officer 共AAER-1560, 2003兲 provided auditors with contracts and
purchase orders with forged signatures in addition to the false confirmations. Ten other cases
involved auditors failing to send confirmations or gather sufficient evidence. For example, in the
Powerball International, Inc. case 共AAER-1985, 2004兲, the auditors relied on a faxed copy of a
bank statement. Another seven cases involved inadequate follow-up on confirmation exceptions,
and four cases involved auditors’ failure to adequately control the confirmation process.
Special Terms and Side Agreements
DQ3: Should an auditing standard on confirmations require auditors to confirm the terms of
revenue transactions? If yes, in what circumstances?
DQ4: Should an auditing standard on confirmations require auditors to confirm the absence
of side agreements and oral modifications of side agreements? If yes, in what
circumstances?
Revenue recognition is a high-risk area, as evidenced by the number of financial statement
restatements involving revenue transactions 共Beasley et al. 1999兲. Academic research has not
directly addressed the existence of special terms or side agreements, or whether confirmations
9
10
Peer review is the review of a CPA firm’s quality control system for its accounting and auditing practice performed by
another CPA firm, and is required for membership in the AICPA. The Sarbanes-Oxley Act requires the PCAOB to
perform inspections of auditors of public companies to assess compliance with the Act, the rules of the Board and the
Securities and Exchange Commission, and professional standards. The PCAOB inspections replace peer review for audit
firms’ public company audit practice.
Details were discussed earlier under the caption “Valuation and Other Assertions.”
Auditing: A Journal of Practice & Theory
November 2008
American Accounting Association
262
Caster, Elder, and Janvrin
TABLE 2
Summary of Confirmation Pitfalls Identified from Accounting and Auditing Enforcement
Releases (AAERs)
Confirmation Pitfall
Number of
Occurrences
Auditee personnel colluded with customer
and customer provided a signed false
confirmation—transactions included
concealed side agreements.
10
Auditee personnel colluded with customer
and customer provided signed false
confirmation—cases did not involve or
mention side agreements.
Auditee personnel provided forged or
false confirmations to auditors.
15
Auditors did not send confirmations or
gather sufficient evidence.
10
10
Auditor performed no or minimal
follow-up on confirmation exceptions.
7
Auditors did not process confirmation
requests properly.
4
Total occurrences
Implication
Auditors might include inquiries about
side agreements in confirmation
requests and may need to consider the
possibility of collusion and gather
other corroborating evidence.
Auditors may need to consider the
possibility of collusion and gather
other corroborating evidence.
Auditors may need to consider procedures
to authenticate confirmation responses,
especially for material items.
Additional guidance regarding when cash
and accounts receivable confirmations
are required or recommended may be
needed.
Auditors may need to demonstrate further
professional skepticism and diligently
perform alternative procedures.
Auditors may need to ensure that
confirmations are sent directly to third
parties and authenticate responses not
received directly by mail.
56
Pitfalls were identified from examination of 113 AAERs involving confirmation requests. Some AAERs involved more
than one confirmation pitfall.
would be effective in detecting the existence of these items. As indicated in Table 2, ten cases
involving collusion included side agreements. We identified an additional 52 AAERs involving 16
companies with concealed side agreements that do not mention confirmations and are not included
in Table 2.
Carmichael 共1991兲 identified several circumstances that may dictate confirmation of transaction terms in addition to account balances. For example, he suggested that confirming transaction
terms may be appropriate for auditees where a moderate-to-high degree of risk of improper
revenue recognition is present. Auditors may note that red flags exist regarding potential management misrepresentations, or that the auditee may have entered into side agreements with certain
customers. For example, several AAERs included revenue recognition issues involving side agreements with resellers in the software industry. Carmichael also suggested that confirming transaction terms may be appropriate when the auditee has “bill-and-hold” transactions or other unusual
revenue recognition policies. Further, Carmichael pointed out that although an auditee’s customer
may not volunteer information on side agreements, they often will report them if auditors ask
specific questions regarding the existence of such agreements.
Auditing: A Journal of Practice & Theory
American Accounting Association
November 2008
A Summary of Research and Enforcement Release Evidence on Confirmation Use and Effectiveness
263
In some cases, the possibility of special terms and side agreements is indicated by the
auditee’s industry, nature of sales agreements, or general economic conditions. It may be relatively
easy to add confirmation of special terms and side agreements to a positive confirmation request;
however, the additional information may decrease already low response rates. In addition, the
individual responsible for confirming account balances may not be knowledgeable about special
terms or side agreements. In the Digital Lava case 共AAER-1807, 2003兲, auditee top management
was unaware of a side agreement made by a salesperson. Research has not assessed the ability of
confirmations to detect side agreements and other special terms, and whether requesting such
information would impact confirmation response rates. Confirming the existence of transactions
and the existence of special terms instead of, rather than in addition to, account balance information may be one technique to mitigate the potential adverse effect on response rates.
SAS No. 99 requires auditors to identify revenue recognition as a specific fraud risk in most
circumstances. Confirming specific revenue transactions or the existence of any side agreements
may be one technique to address revenue recognition fraud risks such as bill-and-hold sales,
channel stuffing, side agreements for return of goods, and other techniques to accelerate revenue.
Confirmation could be limited to individually significant accounts or to situations where, as a
result of auditee inquiry or other procedures, the auditor believes that special terms of a material
nature may exist.
Exceptions to the Use of Confirmations
DQ5: Confirmation of the terms of significant revenue transactions can provide the auditor
with evidence about the existence and amount of any receivable related to the transaction. If a new auditing standard on audit confirmations requires auditors to confirm
the existence and terms of certain revenue transactions, should the current SAS No. 67
requirement to confirm accounts receivable be eliminated?
A few studies have examined the reliability of invoice confirmations as compared to balance
confirmations. We discuss this work since invoice confirmations may share some characteristics
with significant revenue transactions; for example, a significant revenue transaction may involve a
single invoice. Krogstad and Romney 共1980兲 were the first to suggest that confirming an individual sales invoice amount might improve response rates and confirmation accuracy as compared
to confirming an ending account balance, as is usually done. Subsequent studies by Ashton and
Hylas 共1981a兲 and Allen and Elder 共2001兲 did not find any improvements in response rates when
individual sales invoice amounts were confirmed as compared to account balances. No other
academic studies examine the issue of confirming specific details of revenue transactions, such as
side agreements involving the right of return or sales that are essentially consignment sales.
Evidence from several AAERs found that when side agreements are involved between an
auditee and its customers, the customers sometimes cooperate with the auditee by signing false
audit confirmation requests. In the Digital Lava case 共AAER-1807, 2003兲, the auditors specifically
asked about the existence of side agreements, and the auditee’s customer lied to the auditors and
failed to report the side agreement.
Research findings indicated that confirmations are most effective in testing for existence and
suggest alternative procedures may be more effective when testing for valuation. Confirmation of
the existence of a customer relationship and the presence of special terms may provide greater
assurance than traditional balance confirmations. Confirmation of the balance would not be necessary as valuation can be tested using alternative procedures.
DQ6: If the requirement to confirm accounts receivable is retained, should the exceptions to
confirm accounts receivable be retained? If so, should they be clarified?
Auditing: A Journal of Practice & Theory
November 2008
American Accounting Association
264
Caster, Elder, and Janvrin
Under SAS No. 67, a presumption exists that receivable confirmations will be sent unless 共1兲
accounts receivable are immaterial to the financial statements; 共2兲 the auditor’s combined assessed
level of inherent risk and control risk is low, and this assessed level, combined with evidence
provided by analytical procedures or other substantive tests of details, reduces audit risk to an
acceptably low level; or 共3兲 the use of confirmations would be ineffective. The academic and
practitioner literature has not addressed the issue of when it may be appropriate not to send
confirmation requests. Elder and Allen 共2005兲 provided some evidence that reliance on the exceptions in SAS No. 67 to justify the decision to not send confirmations is increasing, but not
widespread. They also noted that auditors do not always justify the decision to not send confirmations.
McConnell and Banks 共1998兲 reported that failure to send confirmations was a problem
commonly found in peer reviews. Auditors also often failed to appropriately document the justification when receivables confirmations were not sent.
AAERs also provide some evidence of a lack of clarity in existing confirmation standards,
although the AAERs do not provide enough details to understand why the auditors chose not to
send confirmation requests. In the Vista 2000, Inc. case 共AAER-1413, 2001兲, 82 percent of recorded sales were fictitious. The auditor failed to examine purchase orders, invoices, shipping
documents, or subsequent cash receipts, and presumably no confirmation requests were sent. In the
case of e-Safetyworld 共AAER-2354, 2005兲, the auditee improperly recorded consulting revenue
and receivables by arbitrarily valuing stock it received from start-up companies in lieu of cash.
Presumably, if confirmations had been sent, the improper valuation would have been detected. In
the case of First American Health Concepts 共AAER-2291, 2005兲, the auditee overstated its accounts receivable by 59 percent. The accounts receivable subsidiary ledger did not reconcile to the
general ledger, and yet, the audit firm failed to send any confirmation requests.
Confirmation of Other Information
DQ7: Should an auditing standard on audit confirmations require auditors to confirm cash
balances? If yes, under what circumstances?
Academic research has not examined the use and effectiveness of cash confirmations. However, a survey of national standards setters by the IAASB found that the quality of responses to
bank confirmations was high in 15 out of 24 countries. Poor quality bank confirmations were not
complete or accurate or were not returned on a timely basis 共IFAC 2006兲.
Confirmation of bank balances is not required under existing auditing standards, but discussions with auditors suggest that confirmation of cash balances is used extensively, even for immaterial amounts. Auditors indicate that the response rate for cash confirmations is high, and these
confirmations may also identify other information such as restrictions on cash and indebtedness.
Further, the AAER involving Powerball International, Inc. 共AAER-1985, 2004兲 highlights the risk
that an auditee may misstate cash when auditors do not confirm cash balances. The president of
Powerball stole cash and hid this from the auditors by altering the bank statements and sending the
statements to the auditors by fax. The auditor accepted the fax copies of the bank statements as
audit evidence and did not send any bank confirmations, even though cash was over two-thirds of
the total assets. Accordingly, it may be appropriate to require confirmation of all material cash
balances.
DQ8: Should an auditing standard on audit confirmations require auditors to confirm balances or transaction terms related to AP, such as purchase commitments? If yes, under
what circumstances?
Auditing: A Journal of Practice & Theory
American Accounting Association
November 2008
A Summary of Research and Enforcement Release Evidence on Confirmation Use and Effectiveness
265
Use of payables confirmations is generally believed to be limited to situations where internal
controls are weak, but their use has not been addressed in academic research. We identified three
AAERs involving confirmation of accounts payable. In the case of Hermitite 共AAER-2, 1982兲 the
auditors sent accounts payable confirmations because of poor internal controls, but failed to follow
up on confirmation exceptions. The poor controls allowed the bookkeeper to embezzle funds,
which was detected by the auditors. Another payables case involved Just for Feet 共AAER-1955,
2004兲 in which the auditee convinced vendors to confirm fictitious amounts.
Auditors are generally more concerned with completeness than existence for accounts payable. As a result, testing for completeness would require sampling from a population that addresses
the possibility of omitted amounts, such as the population of vendors. Confirmation of payables
has generally not been considered necessary since external documentation is usually available.
However, similar to receivables, the auditor may wish to confirm where evidence of material
special terms or commitments exists, such as vendor allowances in the retail industry.
DQ9: Should an auditing standard on audit confirmations require auditors to confirm other
accounts such as investments and marketable securities?
Little academic research exists that examines the effectiveness of confirming other accounts
such as investments, marketable securities and inventories stored in public warehouses. Similar to
confirming cash balances, confirming investments and marketable securities addresses the existence assertion. In addition to the existence assertion, confirmation of investments and marketable
securities may provide evidence in support of the rights 共ownership兲 and valuation assertions.
However, Interpretation 1 of SAS No. 92 共AICPA 2005兲 provides guidance on the use of confirmation evidence for securities and cautions that the mere receipt of a confirmation may not
provide support for the existence or valuation assertions for certain securities. In AAER-2470
共2006兲, a Big 5 audit partner allowed Lipper Holdings to overvalue investments despite evidence
collected from three independent sources indicating investments were overvalued. Technology
currently exists to securely trade investments and marketable securities electronically 共Jones 1993;
Kopeikin 1996兲. Similarly, with technology, an intermediary online link can be established between the auditor and a client’s third party to share data quickly and at a lower cost. This
technology could be adapted to confirm investments and marketable securities holdings.
Negative Confirmations
Existing guidance in SAS No. 67 indicates that negative confirmations may be used when:
共1兲 the combined assessed level of inherent and control risk is low,
共2兲 a large number of small balances are involved, and
共3兲 the auditor has no reason to believe that the recipients of the requests are unlikely to give
them adequate consideration.
International Standard on Auditing 共ISA兲 505 共IFAC 2001兲, paragraph 23, gives similar guidance as follows:
Negative confirmation requests may be used to reduce the risk of material misstatement to an
acceptable level when:
共1兲
共2兲
共3兲
共4兲
the assessed risk of material misstatement is lower,
a large number of small balances is involved,
a substantial number of errors is not expected, and
the auditor has no reason to believe that the respondents will disregard these requests.
The two definitions are substantively equivalent. The first requirement in SAS No. 67 is that
Auditing: A Journal of Practice & Theory
November 2008
American Accounting Association
266
Caster, Elder, and Janvrin
the combined risk assessment is low. In contrast, the ISA requirement is that the assessed risk of
material misstatement is lower, and a substantial number of errors is not expected. The term
“assessed risk of material misstatement is lower” leaves open the question as to how much lower
the assessed risk should be. Research by Elder and Allen 共2003兲 found that assessed combined
inherent and control risk is low on many U.S. audit engagements. It appears that the intent in each
standard is to restrict the use of negative confirmations to areas of very low risk. If that is the case,
more precise terminology or supporting guidance may be necessary to identify when risk is
sufficiently low to justify use of negative confirmations, as well as the definition of a small
balance. This assumes that greater use of negative confirmations is not desirable.
The second issue relates to whether confirmees will give confirmation requests adequate
consideration. This may be an increased concern given anecdotal evidence of declining response
rates to positive confirmation requests. Updated AICPA Practice Alert 2003-01 共AICPA 2007b兲
indicates that auditors may consider the results of positive confirmations in prior years or on
similar engagements when determining whether recipients will give the confirmation request adequate consideration.
Very little evidence exists on the extent of usage of negative confirmations. However, their
use appears restricted to certain industries, such as banks and other financial services, where the
requirements of SAS No. 67 are likely to be met. In a study involving three audit firms and a
sample of manufacturing and distribution companies, Elder and Allen 共2005兲 found that positive
confirmations were used almost exclusively.
Use of Negative Confirmations
DQ10: Since negative confirmations rarely provide evidence about the assertions related to
AR, should an auditing standard on audit confirmations preclude auditors from using
negative confirmations and require them to use only positive confirmations?
As noted previously, the 200 positive confirmation requests sent to fictitious companies at
fictitious addresses by Ashton and Hylas 共1980兲 were all returned as undeliverable. Assuming no
changes in the effectiveness of the post office and no differences in mail delivery effectiveness for
positive and negative confirmations, auditors may assume that negative confirmations were delivered to the recipient.
Little recent evidence exists on the effectiveness of negative confirmations. A review of
AAERs did not reveal the existence of enforcement releases related to the use of negative confirmations. Table 1, Panel C summarizes detection rates for positive and negative confirmations from
selected studies. The gross detection rate is the number of errors detected divided by the number
of confirmations sent. The net detection rate is the number of errors detected divided by the
number of confirmations received. Only a gross detection rate can be calculated for negative
confirmations.
Davis et al. 共1967兲 sent a sample of 350 positive and 497 negative confirmations to bank
customers with balances under $10,000. They did not manipulate the balances to be confirmed.
Instead, the error condition involved a code included on the customer’s statement. The customers
were requested to verify both the balance and the code. The gross 共net兲 detection rate was 59 共64兲
percent for the positive confirmations and 44 percent for the negative confirmations. However,
most of the difference in detection rates was attributable to the use of second requests with
positive confirmations.
Hubbard and Bullington 共1972兲 sent a sample of 100 positive and 100 negative confirmations
to customers of a heating oil distributor. The customers were primarily consumers. Within each
sample, approximately one-third of the accounts were intentionally shown as overstated and another one-third were understated. Both the average account size and error size were quite small.
Auditing: A Journal of Practice & Theory
American Accounting Association
November 2008
A Summary of Research and Enforcement Release Evidence on Confirmation Use and Effectiveness
267
For the misstated accounts, the response rate to positive confirmation requests was higher. However, the error detection rates were not significantly different. Approximately 40 percent of the
errors were detected by the negative confirmations and approximately 48 percent by the positive
confirmations.
Warren 共1974兲 tested the effectiveness of positive and negative confirmations for loan balances for a credit union. The gross 共net兲 detection rate for positive confirmations was 21 共32兲
percent, and the detection rate for negative confirmations was 18 percent. Sorkin 共1978兲 tested
confirmations of loan balances for a large bank. The gross 共net兲 detection rate for positive confirmations was 35 共45兲 percent, and the detection rate for negative confirmations was 18 percent.
Armitage 共1990兲 tested the effectiveness of positive and negative confirmations in an internal
audit setting for a Midwest manufacturing firm. He sent 250 positive and 250 negative confirmations; 200 confirmations in each group were misstated. He manipulated both the direction and size
of the error; the errors were larger than in previous studies. He found that negative confirmations
detected only 16.5 percent of the errors. The detection rates for overstated and understated accounts were 26 percent and 7 percent, respectively. In comparison, positive confirmations discovered 38 percent of the errors, and 27.5 percent of the errors on the first request.
Table 1, Panel C, summarizes evidence from selected studies on error detection rates for
positive and negative confirmations. The evidence indicates that detection rates for negative confirmations are generally statistically significantly lower than those for positive confirmations. The
detection rate for positive confirmations is also quite low. Warren 共1974兲 noted that negative
confirmations are the least informative, but they are also the least costly.
We note that both ISA 505 共IFAC 2001兲 and AICPA Practice Alert 2003-01 共AICPA 2007b兲
indicate that a combination of positive and negative confirmations may be used. ISA 505, paragraph 24, indicates where accounts receivable are made up of a small number of large balances
and a large number of small balances, auditors may decide to use positive confirmations for all or
a sample of the large balances and negative confirmations for a sample of the small balances.
Response rates are higher for smaller account balances 共e.g., Ashton and Hylas 1981b; Bailey and
Ballard 1986兲 suggesting customers would give them adequate consideration. The positive confirmations would provide some substantive evidence on the existence and valuation of receivables.
The evidence in Elder and Allen 共2005兲 suggests that such mixed testing strategies are rarely used
in practice.
Rouse and Lathan 共1986兲 suggested that the use of negative confirmations for small balances
may be more applicable than indicated in the standards. If the auditee sends regular monthly
statements, including a negative confirmation request by use of gummed labels or a sentence
added to the statement can be a low-cost form of evidence to supplement the use of positive
confirmations for larger balances.11
One interesting technique is the use of positive-out, negative-in 共PONI兲 confirmations
共Williams and Ziegler 1987兲. The PONI confirmations are primarily used in place of negative
confirmations. Under this approach, auditors increase the sample size for positive confirmations to
account for the expected nonresponse rate. For example, if the sample size is 60 and the expected
response rate is 50 percent, the revised sample size is 120 共60 ÷ 50 percent兲. If the
expected response rate of 50 percent is realized, auditors will receive 60 positive confirmations,
eliminating the need to send second confirmation requests and perform alternative procedures.
11
The gummed label is an adhesive form that includes the auditor’s negative confirmation request and contact information
and is attached to the customers’ monthly statements sent by the client, eliminating the need to send separate confirmations. Of course, if the auditor attaches labels to the client’s monthly statements, the auditor must control the mailing
of the statements.
Auditing: A Journal of Practice & Theory
November 2008
American Accounting Association
268
Caster, Elder, and Janvrin
These studies suggest that negative confirmations may be underutilized as an approach.
Additional guidance could clarify that the requirements for sending negative confirmation requests
apply when negative confirmations are the only or primary source of evidence regarding accounts
receivable.
Additional Procedures with Use of Negative Confirmations
DQ11: If an auditing standard on audit confirmations continues to permit the use of negative
confirmations in certain circumstances, should the standard require auditors to apply
other substantive procedures to supplement the use of negative confirmations?
We were unable to identify academic research or other relevant literature to address this
normative question. Although tests of controls are not a substantive procedure, the use of negative
confirmations currently requires a low combined assessed level of inherent and control risk. To
justify a low assessment for control risk, auditors must document and test controls. Required
substantive procedures in addition to the use of negative confirmations could add unnecessary cost
if the requirements for sending negative confirmations have been clearly met. It may be appropriate for auditors to use substantive analytical procedures of the account balance tested by the
negative confirmation procedures, and extended procedures where responses to negative confirmations suggest that errors exist in the account balance.
Management Requests Not to Confirm
DQ12: Should an auditing standard on audit confirmations address the auditor’s responsibility when clients request that the auditors refrain from confirming account balances or
other information? If yes, how?
We are unaware of evidence that addressed this issue. A search of recent AAERs did not
identify circumstances involving management requests not to confirm accounts. In an older case
involving J.B. Hanauer 共AAER-13, 1983兲, the auditee requested that multiple accounts involving
fraud not be confirmed. Both Practice Alert 2003-01 共AICPA 2007b兲 and ISA 505 共IFAC 2001兲
indicate that the auditor should consider the reasonableness of the request and perform alternative
procedures. The Practice Alert further indicates that the existence of a dispute is insufficient reason
for not confirming the account and auditors should seek corroborating evidence supporting the
decision not to confirm. ISA 505 indicates that auditors should consider whether the request has
implications regarding management’s integrity or indicates possible fraud or error.
Practice Alert 2003-01 recommends that auditors document in the client representation letter
requests not to confirm, including the reasons for the request. The Practice Alert notes that if the
request not to confirm is considered reasonable, it is not a scope limitation. The magnitude of
the request is not directly discussed in the Practice Alert. However, if the amounts requested not
to be confirmed exceed planning materiality, this could be considered a specific fraud risk that
requires auditors to apply additional procedures beyond standard alternative procedures to establish the existence of the receivables.
Additional Issues
DQ13: Are there other practice issues that should be addressed in an auditing standard on
audit confirmations?
Our review of AAERs and the literature on pitfalls in the confirmation process suggests that
the issues of authentication and automation should be considered. Authentication involves verifying both the identity of the respondent and the absence of intruders during the transmittal process.
Auditing: A Journal of Practice & Theory
American Accounting Association
November 2008
A Summary of Research and Enforcement Release Evidence on Confirmation Use and Effectiveness
269
For example, Parmalat 共AAER-1936, 2003兲 involved a forged cash balance confirmation for $4.9
billion held by a Grand Cayman subsidiary of the company at a New York branch of a major bank.
The confirmation was on a nonstandard confirmation form, but the auditors did not question the
response, despite the amounts involved. The account did not exist, indicating the need to authenticate cash balance confirmation responses and perform additional procedures to validate material
bank balances. Traditionally, the transmittal process involved auditors mailing paper confirmations
to third parties who signed and returned via postal mail the original paper confirmations. To obtain
assurance that no one tampered with the transmittal process, auditors examined each response
looking for any unexplained changes to information. However, auditors need to go further to
establish the validity of responses for material balances.
With automation, auditors can use nontraditional forms of communication such as fax, phone,
and/or email to obtain confirmation information from third parties. For example, auditors may
email their information request to a third party and ask for an electronic response. Furthermore, in
response to confirmation requests, some third parties may provide auditors access to their databases. Several other industries now communicate with customers and vendors electronically 共e.g.,
brokerage firms 共Kopeikin 1996兲, banking 共Zimmermann 1989兲, and healthcare 共Bingham 2001兲兲
and these nontraditional communication forms may increase response rates.
One concern is that these nontraditional communication forms reduce control over the confirmation process and increase the likelihood of fraud. For example, an auditee could intercept a
confirmation request emailed to a vendor, falsely “verify” the information, and return it to the
unknowing auditor. However, technological advances such as authentication protocols and “security paper” are available to verify 共1兲 the identity of the third parties providing electronic responses, and/or 共2兲 the absence of intruders during the transmittal process 共Marcial 2006兲.
Current auditing standards do not address how auditors should authenticate confirmations sent
and/or received via these newer communication forms, although an interpretation of SAS No. 67
共AICPA 2007a兲 indicates if electronic confirmations are secure and properly controlled they may
be considered sufficient, valid confirmation responses. Practice Alert 2003-01 共AICPA 2007b兲
indicates that direct inquiry of a third-party database is not a confirmation but an alternative
procedure. Auditing standards should address whether such inquiries constitute sufficient appropriate evidence.
Other issues arising from our review of AAERs include 共1兲 the prevalence of collusion by
auditee management or other auditee personnel and confirmation respondents, and 共2兲 failure of
auditors to follow confirmation procedures properly. For example, auditors may not follow up on
exceptions or nonresponses, a problem that has been noted in PCAOB inspection reports of
smaller audit firms 共AICPA 2006b兲. Also, they may not consider the effectiveness of confirmations
when selecting sample sizes and evaluating sample results. Although Krogstad and Romney
共1980兲 indicated larger sample sizes should be used for invoice confirmation, Elder and Allen
共2005兲 found that type of confirmation does not impact the confirmation sample size decision in
practice.
Although recent auditing guidance encourages auditors to use computer-assisted audit techniques 共CAATs兲 when selecting confirmation samples 共AICPA 2001; PCAOB 2004a兲, recent research indicates that many auditors are not using CAATs for this purpose 共Janvrin et al. 2009兲. Use
of audit software such as ACL or IDEA offers efficient methods to select and generate confirmations. The effectiveness of these types of audit software would be further enhanced if they were
integrated with electronic techniques to authenticate responses.
Auditing: A Journal of Practice & Theory
November 2008
American Accounting Association
270
Caster, Elder, and Janvrin
SUMMARY AND CONCLUSIONS
We reviewed academic and practitioner research on the use of confirmations, as well as
AAERs. This evidence generally supports the effectiveness of receivables confirmations in testing
for the existence and valuation of accounts receivable, although this effectiveness is hindered by
low response rates. Further, enforcement releases found several confirmation pitfalls, especially a
significant number of cases of collusion between auditees and customers, many involving concealed side agreements. As a result, practitioners may be placing undue reliance on confirmations,
assuming that they are derived from independent sources.
These findings have several implications for standard setters, practitioners, and academic
researchers. First is a need to improve response rates, as well as authenticate responses. Technology, perhaps involving third-party intermediaries, can help address these issues. Second, depending on the circumstances and identified risks, auditors may need to confirm the existence of side
agreements and special terms. Auditors may also need to consider the possibility of collusion in
their testing strategies. In addition, confirmation requirements may need to be extended to other
accounts, at least in some circumstances.
Many questions raised in the SAG report and in our current study have not been addressed by
existing research. We encourage further research in the following areas:
共1兲 Client collusion with confirmees was a significant problem identified in AAERs. What
client and confirmee factors are associated with collusion?
共2兲 Similarly, research could be conducted to determine auditors’ awareness of the prevalence of collusion, forgeries, and false confirmations in detected frauds. How persuasive
do auditors view confirmation evidence, and is this reliance overstated because of the
perception that it is derived from “independent” third parties?
共3兲 Do accounts receivable confirmations inhibit fraud? If confirmations were no longer
required, would creation of fictitious accounts receivable increase?
共4兲 Issues with special terms and side agreements were identified in AAERs, and anecdotally
seem to be associated with certain industries. What factors are associated with the existence of such agreements? When is confirmation of special terms and side agreements
appropriate?
共5兲 Would confirmation of special terms and side agreements in addition to receivable balances adversely impact confirmation response rates?
共6兲 Studies suggest declining response rates to confirmations. Have response rates declined
further, especially after the Sarbanes-Oxley Act? What factors are associated with nonresponses to help guide auditors’ confirmation decisions?
共7兲 Can alternative forms of confirmation requests provide greater assurance? Existing receivable confirmations focus on the valuation of the balance, but the balance is readily
tested using alternative procedures. Research on the effectiveness of confirmations that
focus on any special terms in addition to confirming the account balance would be useful.
共8兲 How effective are alternative procedures in detecting errors? Although an extensive
amount of research has tested the effectiveness of confirmations in detecting seeded
errors, little research has addressed the effectiveness of alternative procedures that may
replace or supplement them.
共9兲 Can mixed testing strategies provide greater levels of assurance? Auditors currently apply
the same techniques to all receivables tested. A mix of positive and negative confirmations, as well as confirmation of special terms for larger or high-risk accounts, may
provide greater assurance.
Auditing: A Journal of Practice & Theory
American Accounting Association
November 2008
A Summary of Research and Enforcement Release Evidence on Confirmation Use and Effectiveness
271
共10兲 How familiar are auditors with existing confirmation standards? Do they understand the
exceptions for when confirmations do not have to be sent? Do these exceptions need
clarification?
共11兲 How prevalent are management requests not to confirm receivables, and how have
auditors responded to those requests?
共12兲 What are the costs and benefits of using electronic communication technologies to send
and receive confirmations, as well as authenticate responses? How do these compare to
authentication techniques for paper confirmations?
There is limited current research on confirmations. Early studies addressed confirmation effectiveness using data from an individual client, while other studies used controlled experiments
based on a single client to assess the effectiveness of various techniques in improving response
rates. It is likely that the lack of current research is at least partially attributable to a lack of data
on accounting firms’ use of confirmations. Many of the research questions we have identified
could be addressed using controlled experiments or archival data from audit firms. We encourage
audit researchers to pursue these questions and audit firms to provide data access to support such
research.
Auditing: A Journal of Practice & Theory
November 2008
American Accounting Association
272
Auditing: A Journal of Practice & Theory
American Accounting Association
TABLE 3
APPENDIX
Citation Summary
Citation
Allen and Elder 共2001兲
Ashton and Hylas 共1980兲
Purpose
Investigate response rates and
error detection rates for
balance and invoice
confirmations.
Determine whether U.S. Postal
Service will return
confirmations that cannot be
delivered.
Research Methods
Reviewed workpapers for 53 audits
of medium-sized companies audited
by three large audit firms.
Mailed 600 confirmations to nonexistent names and/or addresses in 25
cities. Variables manipulated were:
• Recipient 共individual or
business兲
Determine whether differences
in response rates exist for
balance and invoice
confirmations.
• Average response rate was under 50%.
• Response rate was higher for balance than
invoice confirmations.
• Balance confirmations tested greater percentage
of receivables dollars and identified more errors.
• 100% of non-existent names for non-existent
addresses were returned as undeliverable.
• Some confirmations were delivered if an
existing name 共address兲 was used with a nonexistent address 共name兲.
November 2008
• Response rates were significantly higher for
balance than invoice confirmations. Response
rate was 60.8% 共54.4%兲 for balance 共invoice兲
confirmations for first requests, and 72.1%
共64.4%兲 for first and second requests.
• Smaller customers were more likely to respond.
(continued on next page)
Caster, Elder, and Janvrin
Ashton and Hylas
共1981a兲
• Size of city
• Type of postage
• Error 共non-existent addressee
and/or address兲
Mailed 1,344 confirmation requests
to domestic customers of one large
chemical company.
Findings
Citation
Purpose
Ashton and Hylas
共1981b兲
Determine whether various
techniques were effective
in improving confirmation
response rates.
Bailey and Bullard
共1986兲
Determine whether various
techniques were effective in
improving confirmation
response rates.
Assess reliability of positive
confirmation requests.
Mailed 480 confirmations for
customers of large retail firm;
manipulated seven research
variables:
• Type of postage
• Postcard prenotification
• Signature
• Use of letterhead
• Alternative wording
• Statement detail
• Size of account balance
Tested following four techniques
using sample of 593 sales contracts
for real estate company while
controlling for size of account:
• Stamp
Findings
• Prenotification postcards and special postage
共individual stamp, indication of “confirmation
enclosed” or special delivery兲 improved
response rates.
• Stamp, gift pen, and thank you were effective
at improving initial responses.
• Gift pen
• Effects were not additive. One technique was
as effective as two or more.
• After second requests, only gift pen was
associated with significant improvement in
response rates, and only for smaller accounts.
• Attention stamp
• Thank you letter
Mailed confirmations with seeded
errors to 331 steel company
customers. Manipulated variables
were:
• Error direction
• 47% of errors were detected and reported to
auditors.
• Confirmees were somewhat more likely to
detect large unfavorable errors.
(continued on next page)
273
November 2008
American Accounting Association
Caster 共1990兲
Research Methods
A Summary of Research and Enforcement Release Evidence on Confirmation Use and Effectiveness
Auditing: A Journal of Practice & Theory
TABLE 3 (continued)
274
Auditing: A Journal of Practice & Theory
American Accounting Association
TABLE 3 (continued)
Citation
Purpose
Research Methods
• Error size
Davis et al. 共1967兲
Elder and Allen 共2005兲
Assess effectiveness of
various types of
confirmations for personal
demand deposit accounts.
Assess whether firms
decreased use of
confirmations
and changed type of
confirmations used.
• Account balance size
• Account transaction volume
• Account age
Mailed 874 confirmations with
seeded error in account code 共not
account balance兲. Types of
confirmations were:
• Positive confirmations
• Negative confirmation—letter
• Negative confirmation—request
for phone call if discrepancy
Reviewed workpapers for 53 audits
in 1994 and 46 audits in 2000; 28
audits were common to both periods.
Data collected included:
• Whether confirmations were
used
• Account balance size, transaction volume, and
age were not significantly associated with error
detection.
• Response rate for positive confirmations was
91%.
• Detection rate was 59% for positive
confirmations; 44% for negative
confirmations.
• Audit firms were less likely to send
confirmations in latter period, but were still
likely to use confirmations on almost all audits.
November 2008
• Two Big 4 firms extensively used invoice
confirmations and increased their use in later
period.
• Overall response rate was below 50% in both
periods; response rate was higher for balance
confirmations.
• Response rates
(continued on next page)
Caster, Elder, and Janvrin
• Type of confirmation 共balance or
invoice兲
Findings
Citation
Engle 共1991兲
Engle and Hunton
共2001兲
Purpose
Assess whether
prenotifications and small
monetary incentives
increased response
rates for confirmations.
Assess whether small
monetary incentives
improved response rates
and quality.
Research Methods
Mailed confirmations to 240
customers with loan balances at west
central Florida bank. Variables were:
• Prenotifications encouraged timely responses
but did not improve response rates.
• Incentive 共none, $.25, $1.00兲
• Small monetary incentives increased response
rates for installment loans, but only in absence
of prenotification.
• Prenotification 共letter or none兲
• Account 共installment or commercial兲
Mailed 7,200 confirmations to
customers of four large independent
newspaper organizations.
Experimental variables:
• Misstatement 共none,
understatement, overstatement兲
• Incentive 共none, $.25, $1.00兲
File and Ward 共1995兲
Assess reliability of positive
confirmations compared to
negative confirmations.
Examined data from nine audits of
commercial businesses by
midwestern offices of three
international audit firms.
Mailed 102 positive confirmations
and 102 negative confirmations with
small seeded errors to customers of
heating oil company. Errors were all
transposition errors.
• Monetary incentives improved response rates
across all conditions.
• Overstatement errors were more likely to be
detected; incentives did not narrow difference
in detection rates.
• Incentives were associated with decrease in
detection rates.
• CPA letterhead response rate of 36.0% was
lower than response for auditee letterhead
共38.6%兲.
• Responses for auditee letter were six times
more likely to indicate exception.
• Overall detection rate was 48.5% for positive
confirmations; 39.7% for negative
confirmations.
(continued on next page)
275
November 2008
American Accounting Association
Hubbard and Bullington
共1972兲
Determine whether use of
audit letterhead improves
response to second requests.
Findings
A Summary of Research and Enforcement Release Evidence on Confirmation Use and Effectiveness
Auditing: A Journal of Practice & Theory
TABLE 3 (continued)
276
Auditing: A Journal of Practice & Theory
American Accounting Association
TABLE 3 (continued)
Citation
Krogstad and Romney
共1980兲
Sauls 共1970兲
Sauls 共1972兲
Purpose
Assess whether invoice
confirmations increased
response rates and were less
time-consuming than
balance confirmations.
Assess effects of nonresponse
and improper response on
evaluation of accounts
receivable balances.
Comparison of use of balance and
invoice confirmations for one auditee
of large audit firm involving 187
balance confirmations in 1975 and
300 invoice confirmations in 1976.
Mailed 160 confirmations out of a
population of 456 Michigan State
University Credit Union accounts.
Variables manipulated were:
• Seeded error—10% negative and
positive adjustments to account
balance.
• Type 共standard versus blank form兲
Mailed 230 confirmations to personal
loan and automobile loan accounts
for customers of Continental Illinois
National Bank. Sample consisted of:
Findings
• Response rate for positive confirmations was
86% after sending second requests.
• Response rate was 60% for invoice
confirmations compared to 46.5% for balance
confirmations.
• Audit hours decreased from 187 hours with
balance confirmations to 143 hours with
invoice confirmations.
• Overall response rate was 83%.
• Response rate to standard confirmation without
errors was 96%; response rate to blank forms
was 78%.
• Improper responses were received for 17% of
confirmations with seeded errors; no improper
responses were received using blank forms.
• Blank forms appear to reduce improper
responses, but also lower response rates.
• Nonresponse rate for blank forms was almost
double nonresponse rate for standard
confirmations.
(continued on next page)
Caster, Elder, and Janvrin
November 2008
Determine extent of
nonsampling errors in
confirmation of accounts
receivable from
nonresponses and
incorrect responses.
Research Methods
Citation
Purpose
Research Methods
• 100 standard confirmations
without adjustment
Swearingen et al. 共1991兲
Warren 共1974兲
Assess quality of confirmation
responses by businesses,
clerks, and consumers.
• Error type
• Error amount
• Confirmee type
Mailed confirmations to 361 loan and
363 share accounts at Michigan State
University Credit Union. Variables
used:
• Confirmation type 共positive,
negative, blank兲
• Account size 共above or
below median兲
• Account type 共loan or share兲
• No improper responses were received to any
confirmations, including confirmations with
seeded errors.
• Accountants reported more than twice the
errors consumers did 共4.86% of confirmations
compared to 1.68%兲.
• However, there was no difference in average
size of error detected by accountants compared
to consumers.
• Blank and positive confirmations are about
equally informative.
• Negative confirmations are least informative.
277
November 2008
American Accounting Association
Determine informativeness of
positive, negative, and
blank form confirmations
• 30 standard confirmations with
seeded overstatement errors of
approximately 10% of account
balance
• 100 blank form confirmations
Examined confirmation responses
from workpapers of two regional and
seven international CPA firms. Data
collected:
• Error rate
Findings
A Summary of Research and Enforcement Release Evidence on Confirmation Use and Effectiveness
Auditing: A Journal of Practice & Theory
TABLE 3 (continued)
278
Caster, Elder, and Janvrin
REFERENCES
Aldhizer, G., and J. Cashell. 2006. Automating the confirmation process. The CPA Journal 共April兲: 6–10.
Allen, R., and R. Elder. 2001. An empirical investigation of the effectiveness of balance and invoice confirmations. Journal of Forensic Accounting 2: 3–16.
——–, D. Hermanson, T. Kozloski, and R. Ramsay. 2006. Auditor risk assessment: Insights from the academic literature. Accounting Horizons 22 共June兲: 157–178.
American Institute of Accountants 共AIA兲. 1939 Extensions of Auditing Procedure. Committee on Auditing
Procedure. Statement on Auditing Procedure No. 1. New York, NY: AIA.
——–. 1980. Evidential Matter. Statement on Auditing Standards No. 31. New York, NY: AICPA.
——–. 1991. The Confirmation Process. Statement on Auditing Standards No. 67. New York, NY: AICPA.
——–. 2001. The Effect of Information Technology on the Auditor’s Consideration of Internal Control in a
Financial Statement Audit. Statement on Auditing Standards No. 94. New York, NY: AICPA.
——–. 2005. Auditing Derivative Instruments, Hedging Activities, and Investments in Securities: Auditing
Interpretations of Section 332. Interpretation 1 of Statement on Auditing Standards No. 92. New York,
NY: AICPA.
——–. 2006a. Audit Evidence. Statement on Auditing Standards No. 106. New York, NY: AICPA.
——–, Center for Public Company Audit Firms. 2006b. Smaller Firm PCAOB Inspection Deficiency Analysis. New York, NY: AICPA.
——–. 2007a. The Confirmation Process: Auditing Interpretations of Section 330. Interpretation 1 of Statement on Auditing Standards No. 67. New York, NY: AICPA.
——–, Professional Issues Task Force. 2007b. Practice Alert 2003-01, Audit Confirmations. New York, NY:
AICPA.
Armitage, J. 1990. Accounts receivable confirmation effectiveness. Internal Auditing 共Summer兲: 15–24.
Ashton, R., and R. Hylas. 1980. The return of problem confirmation requests by the U.S. Postal Service. The
Accounting Review 55 共October兲: 649–657.
——–, and R. Hylas. 1981a. A study of the response to balance and invoice confirmation requests. Journal of
Accounting, Auditing and Finance 4: 325–332.
——–, and ——–. 1981b. Increasing confirmation response rates. Auditing: A Journal of Practice & Theory
1 共Summer兲: 12–22.
Bailey, C., and G. Ballard. 1986. Improving response rates to accounts receivable confirmations: An experiment using four techniques. Auditing: A Journal of Practice & Theory 5 共Spring兲: 77–85.
Beasley, M., J. Carcello, and D. Hermanson. 1999. Fraudulent Financial Reporting: 1987–1997: An Analysis
of Public Companies. Committee of Sponsoring Organizations of the Treadway Commission. Jersey
City, NJ: AICPA.
Bingham, A. 2001. Internet-based eligibility verification lowers costs, improves payment timeliness. Healthcare Financial Management 55 共February兲: 47–49.
Bonner, S., Z-V. Palmrose, and S. Young. 1998. Fraud type and auditor litigation: An analysis of SEC
accounting and auditing enforcement releases. The Accounting Review 73 共October兲: 503–532.
Carmichael, D. 1991. Pitfalls in the confirmation process. The CPA Journal 共June兲: 54–56.
Caster, P. 1990. An empirical study of accounts receivable confirmations as audit evidence. Auditing: A
Journal of Practice & Theory 9 共Fall兲: 75–91.
Davis, G., B. Neter, and R. Palmer. 1967. An experimental study of audit confirmations. Journal of Accountancy 共June兲: 36–44.
Dechow, P., R. Sloan, and A. Sweeney. 1996. Causes and consequences of earnings manipulation: An
analysis of firms subject to enforcement action by the SEC. Contemporary Accounting Research 13
共Spring兲: 1–36.
Elder, R., and R. Allen. 2003. A longitudinal field investigation of auditor risk assessments and sample size
decisions. The Accounting Review 78: 983–1002.
——–, and ——–. 2005. An empirical investigation of changes in confirmation procedures. Working paper,
Syracuse University.
Engle, T. 1991. Increasing confirmation response rates: Prenotifications, monetary incentives and address
differences. Journal of Accounting, Auditing and Finance 6 共1兲: 109–127.
Auditing: A Journal of Practice & Theory
American Accounting Association
November 2008
A Summary of Research and Enforcement Release Evidence on Confirmation Use and Effectiveness
279
——–, and J. Hunton 2001. The effect of small monetary incentives on response quality and rates in the
confirmation of accounts receivable balances. Auditing: A Journal of Practice & Theory 20 共March兲:
157–168.
File, R., and B. Ward. 1995. Improving the results of second request confirmation procedures. Auditing: A
Journal of Practice & Theory 14 共Spring兲: 87–93.
Hubbard, T., and R. Bullington. 1972. Positive and negative confirmations—A test. Journal of Accountancy
共March兲: 48–56.
International Federation of Accountants 共IFAC兲. 2001. External Confirmations. International Standard on
Auditing 505. New York, NY: IFAC.
——–. 2006. External Confirmations—Issues Paper. New York, NY: IFAC.
Janvrin, D., J. Bierstaker, and J. Lowe. 2009. An investigation of factors influencing the use of computerrelated audit procedures. Journal of Information Systems 共forthcoming兲.
Jones, D. 1993. First tests of electronic confirmation links. Financial Technology International Bulletin 11
共November兲: 6–7.
Kopeikin, R. 1996. Secure trading on the net. Telecommunications 共October兲: 89–94.
Krogstad, J., and M. Romney. 1980. Accounts receivable confirmation: An alternative approach. Journal of
Accountancy 149 共February兲: 68–74.
Marcial, G. 2006. Watch it counterfeiters. BusinessWeek 共February 13兲: 92.
McConnell, D., and G. Banks. 1998. A common peer review problem. Journal of Accountancy 185 共June兲:
39–44.
Peloubet, M. 1939. The McKesson and Robbins case. The Chartered Accountant in Australia 共May兲: 722–
733.
Public Company Accounting Oversight Board 共PCAOB兲. 2004a. An Audit of Internal Control Over Financial
Reporting Performed in Conjunction with an Audit of Financial Statements. Release No. 2004-001
共March 9兲. Washington, D.C.: PCAOB.
——–. 2004b. Standing Advisory Group Meeting: Audit Confirmations. September 8–9. Washington, D.C.:
PCAOB.
Rouse, R., and M. Lathan. 1986. Improving the confirmation process. The CPA Journal 共December兲: 58–61.
Sauls, E. 1970. An experiment on nonsampling errors. Journal of Accounting Research 共Supplement兲: 157–
171.
——–. 1972. Nonsampling errors in accounts receivable confirmation. The Accounting Review 47 共January兲:
109–115.
Sorkin, H. 1978. The Expanded Field Confirmation. IIA Research Report No. 21. Altamonte Springs, FL: The
Institute of Internal Auditors 共IIA兲.
Swearingen, J., F. Wilkes, and S. Swearingen. 1991. Confirmation response differences between businesses,
clerks and consumers. The CPA Journal 共May兲: 58–60.
Warren, C. 1974. Confirmation informativeness. Journal of Accounting Research 12 共1兲: 158–177.
Williams, D., and T. Ziegler. 1987. Positive-out negative-in confirmations–An innovative confirmation approach. The CPA Journal 共July兲: 78–81.
Zimmermann, K. 1989. Reg. CC, marketing perks, spark interest in signature verification. Bank Systems &
Equipment 26 共April兲: 64–67.
Auditing: A Journal of Practice & Theory
November 2008
American Accounting Association