SA 505 External Confirmations: Debtors, Creditors and Banks

What external confirmations establish

Under SA 505, an external confirmation is a written response sent directly to the auditor by a third party, in paper or electronic form or another medium. SA 500 explains that independent, documentary evidence obtained directly is generally more reliable, though its source, circumstances and authenticity still matter. SA 330 requires the auditor to consider whether to use confirmations as substantive procedures. It does not prescribe the same procedure for every material account.

Confirmations may cover receivables, payables, bank balances, borrowing terms, guarantees, letters of credit, deposits, pledged assets or other relevant facts. Determine the assertion being tested. For litigation and inventory held by third parties, also apply the specific requirements of SA 501. A receivable confirmation primarily supports the balance or specified terms; it does not establish collectibility.

Choose and control the request

Design	Response requested	Evidence and limits
Positive	Reply directly in every case. Confirm or disagree with stated information, or supply it in a blank request.	A blank request reduces the risk of agreement without checking, but may lower response rates. For each non-response perform alternative procedures under paragraph 12, subject to paragraph 13.
Negative	Reply directly only if the stated information is incorrect.	Silence is weak evidence and does not establish agreement or even receipt. Paragraph 15 restricts its use as the sole substantive procedure for the assertion.

Negative requests can be the sole substantive procedure at an assertion only if all four conditions apply: the assessed risk is low and there is sufficient appropriate evidence that relevant controls operated effectively; the population contains many small homogeneous items; very few exceptions are expected; and the auditor knows of no circumstances that would lead recipients to disregard the request. If a condition fails, do not rely on negative requests alone.

Under paragraph 7, the auditor determines what to confirm, selects the appropriate knowledgeable parties, designs and properly addresses requests with a direct return route, and sends and follows up on them. The entity may authorise disclosure, but the auditor controls the selection, dispatch and return. Independently verify addresses and identities where warranted. A secure portal can help maintain control, but assess its design, authority of respondents, evidence integrity and access; a particular technology is not required by SA 505. For bank evidence, ICAI’s 2022 advisory recommends obtaining confirmation directly from the concerned bank because of the risks in vendor-mediated responses.

Handle refusal, non-response and conflicting evidence

Management refuses: Under paragraph 8, ask why and obtain evidence of the reason’s validity and reasonableness, reassess relevant misstatement and fraud risks and perform alternative procedures. Under paragraph 9, if the refusal is unreasonable or alternatives fail to yield relevant and reliable evidence, communicate with those charged with governance under SA 260 and evaluate the opinion under SA 705 (Revised).
No, incomplete or undelivered positive response: Follow up when appropriate, investigate delivery issues and perform alternatives for each non-response. If the auditor has determined a positive response is necessary to obtain sufficient appropriate evidence, paragraph 13 states that alternatives cannot provide the evidence required; evaluate the reporting implications if the response cannot be obtained.
Unreliable or indirect response: Obtain further evidence to resolve doubts about source, authority or integrity. A response routed through management is not a direct confirmation; seek a fresh direct reply where appropriate and evaluate any other evidence on its merits. An oral callback can corroborate identity or facts but is not itself a written confirmation. If a response is unreliable, reassess risks and related procedures.
Exception: Under paragraph 14 investigate each difference to determine whether it indicates a misstatement. Test whether a difference is a timing item, disputed deduction, missing invoice or sign of fraud. Under paragraph 16 assess whether the results as a whole provide relevant and reliable evidence or whether further evidence is needed.

Design alternatives by assertion

Area	Examples of alternative or corroborating evidence	What to watch for
Receivables	Match subsequent receipts to the original invoices and independently reliable bank evidence; inspect contracts, dispatch and delivery records and customer acceptance.	A receipt may relate to another invoice, an advance or a circular transfer. Verify cut-off under the applicable revenue policy and assess impairment separately.
Payables	Inspect external supplier statements, subsequent payments and invoices, receiving reports and unmatched receipts. Search for liabilities for goods and services received by year end.	Start from external or later payment records when testing completeness. Verify which period bears the obligation, even when the invoice arrives later.
Cash and borrowings	Test bank reconciliations, original facility and security agreements and later bank statements; inspect the MCA register of charges where useful.	Bank statements may support balances and clearing of reconciling items without proving completeness of guarantees, liens or terms. A public charge record is corroboration and does not substitute for a necessary bank response.

Six worked audit cases

1. Unanswered receivable and year-end cut-off

Sterling Pharma has ₹65 crore of receivables on 31 March 2024. The audit team selects 15 balances totalling ₹48 crore (73.85%). MediHealth owes ₹6.20 crore according to the ledger (9.54% of total receivables, above ₹1.50 crore performance materiality) and does not answer requests dated 15 April and 5 May. Assume the auditor did not determine that a direct positive response was indispensable under paragraph 13.

Invoice	Ledger amount	Subsequent evidence
12 January, INV-4102	₹1.85 crore	Matched to the 18 April receipt and independently corroborated delivery evidence.
4 February, INV-4350	₹2.10 crore	Matched to the 9 May receipt and independently corroborated delivery evidence.
28 March, INV-4890	₹2.25 crore	₹25 lakh received on 22 May; delivery accepted on 2 April, with a ₹45 lakh damage claim on 25 April. ₹2 crore was unpaid before assessing the claim; ₹1.55 crore remains if that claim is allowed in full.

Assume contract terms and delivery evidence establish that control did not pass before 2 April. Reverse the entire ₹2.25 crore premature March revenue and corresponding receivable, leaving ₹3.95 crore from the first two invoices before any other adjustments. Reinstate any prematurely expensed inventory at its appropriate carrying amount and assess whether evidence before the 20 July audit report identifies damage or impairment that existed at 31 March. Evaluate the ₹45 lakh claim, the later ₹25 lakh receipt and any unpaid amount in the proper reporting period. A later receipt does not cure March cut-off.

2. Management refuses confirmation of a possible related-party advance

BluePeak has an unsecured ₹18.50 crore advance to Shivalik, in which the promoter’s brother owns 40%. There has been no principal or interest receipt for about 14 months. The managing director objects to a request, citing acquisition talks. The auditor inspects the board records and other correspondence, tests that explanation and corroborates the January 2023 disbursement. Shivalik’s reported ₹12 crore negative net worth, ₹40 lakh revenue and bank defaults are indicators for the risk and recoverability assessment. Evaluate Ind AS 109 impairment where applicable; the facts alone do not prove that the loss allowance is exactly ₹18.50 crore.

Determine the parties’ roles, control, legal relationships and applicable exemptions before concluding under Sections 185 and 186 or the related-party requirements. A promoter’s relative owning shares does not alone establish a Section 185 violation. Communicate an unreasonable refusal to governance and assess the effect of insufficient evidence or uncorrected material misstatement on the opinion. Consider CARO paragraph 3(iii) and (iv) where applicable. Under Section 143(12) and Rule 13, assess whether there is reason to believe an officer or employee committed fraud against the company, and determine the reporting route. Central Government reporting applies to a qualifying fraud of at least ₹1 crore individually; a qualifying fraud below that threshold is reported to the Audit Committee or Board, as applicable. Neither a particular opinion nor a Central Government fraud report follows automatically from this refusal.

3. Reconcile a supplier’s higher balance

AutoCraft’s ledger shows ₹142.80 lakh. Add ₹44.20 lakh for goods received on 31 March and not yet booked, ₹18.50 lakh for a price deduction unsupported by the contract, and ₹15 lakh for a cheque held by AutoCraft at year end and handed over on 4 April. Assume the facts support reversal of the premature payment entry. The three adjustments total ₹77.70 lakh, giving a correct client liability of ₹220.50 lakh.

AutoCraft already recorded a ₹2 lakh RTGS payment. The supplier received it by 31 March but posted it to the wrong customer, so its raw confirmation shows ₹222.50 lakh, or ₹79.70 lakh more than the original AutoCraft ledger. Deduct the ₹2 lakh only from the supplier’s confirmation to reconcile to ₹220.50 lakh. The auditor verifies the payment, ensures the supplier misposting does not create another client adjustment, and documents the entries and remaining evidence.

4. Verify a suspicious electronic response

Dynamic Overseas has a USD 850,000 ledger receivable. At an illustrative common rate of ₹82.94 per USD the carrying amount is approximately ₹7.05 crore. A response from a free email address agrees with the amount. The domain and apparent routing are reasons to follow up, not evidence by themselves of the sender’s identity. An independent callback reveals that the customer did not send the reply and reports USD 150,000 owed. Obtain a fresh direct written response and corroborate it with contracts, cancellation notices and delivery evidence. If USD 700,000 relates to cancelled orders for which control never transferred, the illustrative reduction is ₹5.81 crore at the assumed rate, leaving about ₹1.24 crore. Reassess fraud risks, document who sent the false response only when the evidence supports it, and apply SA 240 and the applicable reporting law.

5. Bank confirmation reveals security and a borrowing difference

Zenith Power’s four-bank confirmation programme covers balances, loans, guarantees and pledged assets. The lead bank confirms ₹22.78 crore of cash credit against the ledger’s ₹22.50 crore, a ₹28 lakh difference, and agrees the ₹45 crore term loan. If independent records establish that the ₹28 lakh is a valid charge attributable to the year, record the applicable expense and increase the borrowing balance.

The same confirmation discloses a ₹14.50 crore bank guarantee issued for an associate. Obtain the bank and counter-indemnity documents to identify the reporting company’s obligation. If it issued a financial guarantee contract within Ind AS 109, apply that standard; if another form of obligation falls within Ind AS 37, assess recognition or disclosure there. The bank’s confirmation does not by itself determine the accounting. Another bank confirms a ₹4.50 crore deposit pledged for a third party. Verify maturity, availability and the nature of the lien, then classify and disclose the restricted balance under Ind AS 7 and applicable Schedule III requirements; do not continue presenting it as freely available cash.

6. A large homogeneous loan portfolio

FinGrow has ₹50 crore across 25,000 borrowers, an average balance of ₹20,000. A 0.04% historical exception rate equates to 10 items if applied to the current population, but the team tests the current controls and whether that rate is still a reasonable expectation. It has documented delivery problems and reasons to expect some recipients to disregard negative requests, so paragraph 15 precludes using negative requests as the sole substantive procedure. It considers positive confirmations for 250 borrowers (1% of the population) and inspection visits at 25 branches. The stated sample size is illustrative; validate the design, risk, tolerable misstatement and sampling method under SA 530. An authentication code by itself is not the borrower’s written confirmation.

Documentation and common questions

What should the file contain? Record the assertion, population, selection, address verification, dispatch, replies, reminders, exceptions, alternatives and evaluation. A confirmation register, evidence file, reconciliation and alternatives schedule are useful workpapers; SA 505 does not prescribe their names.
Can a supplier statement given by the client be used? It may be relevant alternative evidence. Assess the external origin, completeness and reliability of the copy. It is not a direct response to a confirmation request.
Does agreement mean the debt is collectible? No. Inspect payment patterns, credit information and other relevant evidence and apply the applicable impairment framework. A debtor can confirm an amount it will not pay.
What if the address is wrong? Treat returned mail as a non-response, verify independently sourced contact details, resend when appropriate and perform the applicable alternatives. Investigate risk indicators without assuming an invalid address proves fraud.
Does a scope limitation automatically change the opinion? Under SA 705 (Revised), an inability to obtain sufficient appropriate evidence leads to qualification if possible effects are material but not pervasive and a disclaimer if they could be both material and pervasive, subject to the standard’s requirements. An identified uncorrected misstatement calls for a separate materiality and pervasiveness assessment; an adverse opinion may be appropriate if the effects are material and pervasive.