PCAOB Adopts a New Confirmation Standard
On September 28, the Public Company Accounting Oversight Board (PCAOB) adopted a new standard on the auditor’s use of confirmations. See The Auditor’s Use of Confirmation, and Other Amendments to PCAOB Standards. The new standard, which the Board describes as modernizing and strengthening the existing confirmation requirements, was originally proposed for comment in 2010 and reproposed with changes in 2022. See PCAOB Proposes to Modernize Confirmations, January 2023 Update. Assuming SEC approval, the new standard and related amendments to existing standards will take effect for audits of financial statements for fiscal years ending on or after June 15, 2025.
Confirmation is the process of verifying information about one or more financial statement assertions with a third party. Key features of the new confirmation standard include:
Cash and cash equivalents. For cash and cash equivalents held by a third party, the auditor should perform confirmation procedures or otherwise obtain relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source. The current standards do not address cash confirmation.
Confirmation of accounts receivable. For accounts receivable that arise from the transfer of goods or services to a customer or a financial institution’s loans, the auditor should perform confirmation procedures or otherwise obtain relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source. (Confirmation of accounts receivable has been presumptively required in the United States since 1939.) The new standard recognizes that there may be situations in which the auditor determines that confirmation or access to third party information is not feasible. In those cases, the auditor should document that determination and instead “should obtain external information indirectly by performing other substantive procedures, including tests of details.” As discussed below, the auditor will also be required to communicate with the audit committee when it determines not to confirm accounts receivable, if accounts receivable is a significant audit risk.
Negative confirmations. The standard states that the use of negative confirmation requests alone does not provide sufficient appropriate audit evidence. (A negative confirmation request is one in which the auditor requests a confirmation response only if the confirming party disagrees with the information provided in the confirmation request.) The standard includes examples of situations where the auditor may use negative confirmation requests to supplement other substantive audit procedures.
Limited use of internal audit in the confirmation process. Under the new standard, the auditor must maintain control over the confirmation process to minimize the likelihood that information exchanged between the auditor and the confirming party is intercepted or altered. Specifically, the “auditor should (i) select the items to be confirmed, (ii) send confirmation requests, and (iii) receive confirmation responses.” By implication, therefore, the auditor cannot delegate any of these three functions to the company’s internal audit staff. A footnote to the standard states that the auditor “may use internal auditors to provide direct assistance in other aspects of the confirmation process.”
Performing Alternative Procedures. The standard identifies situations in which alternatives to confirmation should be performed by the auditor and includes examples of such alternative procedures.
The 2022 confirmation proposal included a requirement that the auditor communicate with the audit committee whenever the auditor determined that the presumption to confirm accounts receivable had been overcome and the auditor intended to use alternative procedures. Some commenters objected to this provision on the grounds that the requirement to communicate with the audit committee should be limited to situations in which accounts receivable presented a significant risk. The final standard addresses these concerns by requiring that the auditor communicate with the audit committee about the auditor’s response to significant risks associated with cash or accounts receivable when the auditor did not perform confirmation procedures or otherwise obtain audit evidence by directly accessing information maintained by an external source.