SA 505 External Confirmations explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
SA 505 tells an auditor how to use external confirmations: written replies that come straight from a third party such as a bank, a customer or a supplier. It covers how a request is prepared and sent, what to do if management will not allow it, and how replies, silence and differences are treated.
SA 505, as effective for audits of financial statements for periods beginning on or after 1 April 2010, applies whenever an auditor chooses to confirm balances or terms with outside parties. ICAI may revise standards, so check icai.org for the current text. Clean party-wise ledgers make this work easier, which is where books of accounts compliance support helps.
The auditor keeps control of the confirmation process from choosing what to confirm to sending the request, and replies must reach the auditor directly. If management refuses to allow a request, the auditor asks why, tests the reasons and performs alternative procedures; an unreasonable refusal goes to those charged with governance and may affect the opinion. Every non-response needs alternative procedures, every exception is investigated, and negative confirmations alone are allowed only if four conditions are all met.
What SA 505 covers (paragraphs 1-6)
The standard deals with external confirmation procedures as a way of getting evidence under SA 330 and SA 500 (paragraph 1). It does not deal with letters to lawyers about litigation; that is in SA 501. The reason confirmations matter is reliability: evidence from an independent outside source, received directly by the auditor and in written form, can be more reliable than what the entity produces internally (paragraph 2). See SA 500 for the general principles.
The objective is to design and perform confirmation procedures that produce relevant and reliable evidence (paragraph 5).
| Term (paragraph 6) | Plain meaning |
|---|---|
| External confirmation | A direct written reply from a third party to the auditor, on paper or electronic |
| Positive request | The third party must reply, saying whether it agrees or giving the information asked for |
| Negative request | The third party replies only if it disagrees |
| Non-response | No reply, an incomplete reply to a positive request, or a request returned undelivered |
| Exception | A reply showing a difference between what the entity recorded and what the third party says |
Keeping control of the process (paragraph 7)
Whenever confirmations are used, the auditor stays in charge of four steps. First, deciding what is to be confirmed: usually account balances and their elements, but also the terms of agreements or even the absence of a "side agreement" (A1). Second, choosing the right party, someone who actually knows the matter, such as a knowledgeable officer at a financial institution (A2). Third, designing the request so it is properly addressed and asks for the reply to go directly to the auditor. Fourth, sending it and following up where needed.
The application material gives design points worth knowing. The layout, the method of sending, past experience, the risks identified (including fraud risks) and whether management has authorised the third party to reply all affect the response rate and reliability (A3-A4). A positive request that states the amount is easy to answer but invites a careless "agreed"; a "blank" request that asks the party to fill in the amount reduces that risk but may bring fewer replies (A5). Some or all addresses should be tested before sending (A6), and a follow-up may be sent after re-verifying the address (A7).
When management refuses a request (paragraphs 8-9)
If management does not allow the auditor to send a request, the auditor must:
- ask for the reasons and seek evidence that they are valid and reasonable (A8 notes a legal dispute or ongoing negotiation as a common reason, and the risk that management may be keeping the auditor away from evidence of fraud or error);
- assess what the refusal means for the risks of material misstatement, including fraud risk, and for other procedures (A9 says an unreasonable refusal may itself be a fraud risk factor); and
- perform alternative procedures that give relevant and reliable evidence.
If the refusal is unreasonable, or the alternative procedures do not give the evidence needed, the auditor communicates with those charged with governance and considers the effect on the opinion under SA 705 (paragraph 9). See SA 260.
Results of the procedures (paragraphs 10-16)
| Situation | What the auditor does | Paragraph |
|---|---|---|
| Doubt about a reply's reliability | Obtains further evidence to resolve the doubt | 10 |
| Reply judged unreliable | Reassesses risks, including fraud risk, and adjusts other procedures | 11 |
| Non-response | Performs alternative procedures for each one | 12 |
| Positive reply is essential and not received | Considers the effect on the audit and the opinion | 13 |
| Exception | Investigates whether it points to a misstatement | 14 |
| Negative requests | Uses them alone only if four conditions hold | 15 |
| End of the work | Judges whether the evidence is enough or more is needed | 16 |
Reliability of replies
Every reply carries some risk of interception, alteration or fraud, whether on paper or electronic (A11). Red flags include a reply that reached the auditor indirectly or did not seem to come from the intended party. Email and fax raise particular difficulty in proving who sent them; a secure process agreed with the respondent can reduce the risk (A12), and where an outside party coordinates replies the auditor may address whether it is the right source and authorised to answer (A13). A practical fix is to phone the confirming party to check it sent the reply, or ask for a fresh reply sent directly (A14). A spoken reply is not an external confirmation by itself; the auditor may ask for it in writing (A15). Restrictive wording on the reply does not necessarily destroy its value (A16).
Non-responses
For each non-response the auditor performs alternative procedures (paragraph 12). For debtors, A18 mentions examining specific later cash receipts, shipping documents and sales near the year-end. For creditors it mentions later payments, third-party correspondence and goods received notes. An unusual number of replies, fewer or more than expected, may reveal a fraud risk factor not seen before (A19).
Where information exists only outside the entity, or fraud risks such as management override or collusion mean the auditor cannot rely on internal evidence, a positive reply may be essential, and alternative procedures will not do. If it is not received, the opinion may have to be modified (paragraph 13, A20).
Exceptions
Exceptions are investigated to see whether they are misstatements (paragraph 14). They may also point to weaknesses in internal control and show how reliable other replies from similar parties are (A21). Some are not misstatements at all: timing differences, measurement differences or clerical errors in the confirmation process (A22).
Negative confirmations
The standard treats these as weak evidence. Silence does not prove the request was received or checked (A23). Negative requests cannot be the only substantive procedure for an assessed risk unless all four are true: the risk is assessed as low with evidence that controls operate effectively; the population is a large number of small, similar balances; a very low exception rate is expected; and the auditor knows of nothing that would make recipients ignore the request (paragraph 15). A23 adds that people are likelier to reply when a balance is understated against them than when it is overstated, so the method suits testing understatement better than overstatement.
Illustrative example
Orchid Textiles Pvt Ltd is an invented company with 240 customer balances at year-end (all figures illustrative). The auditor sends positive requests to the 30 largest customers and uses addresses taken from independent records rather than the invoice file alone. Twenty-four reply with agreement. Four do not reply, so the auditor examines the receipts that arrived in April and the dispatch records near year-end. One reply shows a lower balance because the customer's payment was in transit at year-end, a timing exception. One reply comes by email from a personal address, so the auditor phones the customer to confirm it was sent. Orchid's finance head asks the auditor not to write to one distributor because of a pending price dispute; the auditor asks for evidence of the dispute and still performs alternative procedures.
Documentation and links to other SAs
SA 505 contains no separate documentation paragraph; the auditor records the work in line with SA 230. The evidence feeds the responses required by SA 330, and for choosing which balances to confirm see SA 530. The text prints no modifications compared with the international standard.
Need help with confirmations?
Accounts teams can make confirmation work smoother by keeping party-wise ledgers, current addresses and reconciliations ready. TaxClue's books of accounts compliance support can help you prepare balance schedules and reconcile differences before the auditor sends requests.
Key takeaways
- An external confirmation is a direct written reply from a third party to the auditor.
- The auditor controls what is confirmed, who is asked, the wording and the sending.
- A refusal by management must be questioned and answered with alternative procedures.
- Every non-response needs alternative procedures; every exception needs investigation.
- Negative confirmations alone are allowed only when all four conditions in paragraph 15 are met.
Read next
- SA 500: audit evidence
- SA 501: inventory, litigation and segment information
- SA 530: audit sampling
- SA 510: opening balances in a first audit
Disclaimer: Based on the Standards on Auditing and quality standards issued by the Institute of Chartered Accountants of India, in the versions named in the article, and ICAI's announcement of 31 March 2026 on SQM 1 and SQM 2, as consulted on 3 October 2026. ICAI revises standards from time to time; check the current text and effective dates on icai.org. This article is general information, not legal advice; check the official text before acting.