Cash is easy to understand. It is also easy to misunderstand. A general ledger may show a clean balance. A bank statement may appear consistent. A reconciliation may clear every outstanding item. Yet the audit evidence supporting that cash balance can still be weak.
Confirmation failures expose this problem.
A nonresponse, an unexplained exception, an unusual email address, or a response routed through the client is not merely an administrative issue. Each can tell the auditor something about the quality of the evidence, the reliability of the process, or the underlying risk.
For CPAs, that makes a failed cash confirmation worth a close examination.
A failed confirmation changes the evidence picture
A confirmation does not prove that a balance is correct simply because a response arrives.
The auditor must consider who responded, how the response was obtained, whether the confirming party was appropriate, and whether the information is consistent with other audit evidence.
The PCAOB’s current AS 2310, The Auditor’s Use of Confirmation, makes this explicit. The standard focuses on obtaining relevant and reliable audit evidence from a knowledgeable external source. It also requires auditors to consider confirmation results in the context of the assessed risks of material misstatement, including risks of fraud. AS 2310 applies to audits of financial statements for fiscal years ending on or after June 15, 2025.
That last point matters.
If confirmation evidence contradicts the evidence supporting the original risk assessment, the auditor should reconsider the risk assessment and modify the planned procedures where necessary.
A failed confirmation can therefore change the audit. It should not simply change the follow-up schedule.
The first lesson: verify cash outside the client’s reporting system
Management prepares the books. Management also prepares the bank reconciliation.
Those records are important audit evidence. They are not independent evidence of the same strength as information obtained directly from the financial institution.
This is why external confirmation remains particularly important for cash. The bank can provide evidence about the existence of an account, its balance, and other relevant aspects of the banking relationship.
Under AS 2310, auditors must perform confirmation procedures for cash held by third parties or otherwise obtain relevant and reliable evidence by directly accessing information maintained by a knowledgeable external source. The standard also requires auditors to consider the company’s cash-management and treasury activities when selecting individual cash items.
The practical lesson is straightforward: Do not let the client’s cash schedule become the endpoint of the cash test.
The auditor needs evidence that originates outside the client’s reporting process.
For U.S. auditors following AICPA standards, this principle has also become more explicit. In July 2026, the AICPA Auditing Standards Board issued SAS No. 150, External Confirmations. The standard introduces a new requirement concerning external confirmation procedures for cash and cash equivalents held by third parties, subject to specified conditions.
This is not a minor procedural update.
It signals where the profession is placing greater emphasis: cash evidence should be anchored in an independent external source.
The second lesson: the auditor must control the confirmation
Consider two confirmation processes. In the first, the auditor selects the bank account, sends the request, and receives the response directly from the bank. In the second, the client prepares the request, sends it to the bank, receives the response, and forwards it to the auditor.
Both processes may produce a document. They do not produce evidence of equal reliability.
AS 2310 requires the auditor to maintain control over the confirmation process. The auditor selects the items, sends the requests, and receives the responses directly from the confirming party.
This requirement addresses a basic risk: interception or alteration of information. It is also a lesson reinforced by past enforcement actions.
In its enforcement action involving PwC and the Satyam fraud, the SEC described failures in confirming cash balances and in the auditors’ reliance on confirmation procedures that were not adequately controlled.
The broader lesson remains relevant.
A confirmation is not inherently independent merely because it comes from a bank. The process used to obtain it also matters.
The third lesson: electronic does not automatically mean reliable
Modern confirmation processes are often electronic. That is an improvement in speed. It is not a substitute for authentication.
AS 2310 specifically addresses electronic communications and third-party intermediaries. Where an intermediary is used, auditors must consider controls designed to prevent the interception or alteration of confirmation requests and responses. They must also consider whether the client could override those controls.
The standard identifies warning signs that may call the reliability of a response into question. These include a response coming from an address different from the one used for the confirmation request, a response that does not adequately identify the confirming party, or a response that lacks evidence connecting it to the original request.
The key question is simple:
Can the auditor establish that the response came from the intended confirming party and was not altered during the confirmation process?
That question is more important than the format of the response.
A PDF, email, or electronic confirmation is useful only to the extent that the auditor can establish its reliability and its connection to the original confirmation request.
The fourth lesson: confirm the banking relationship, not just the balance
Cash rarely exists in isolation. A company may maintain several bank accounts. It may also have credit facilities, debt, compensating-balance arrangements, guarantees, pledged assets, or other relationships with the same institution.
A confirmation that establishes a cash balance may therefore leave important questions unanswered.
AS 2310 requires auditors to consider confirming other financial relationships with the source of cash information based on the assessed risk of material misstatement. Examples include lines of credit, other indebtedness, compensating-balance arrangements, and contingent liabilities such as guarantees.
This matters because the relevant audit question is not simply:
“Does the company have $10 million in the bank?”
It may be: “What is the company’s complete financial relationship with this institution at the reporting date?”
That distinction can affect assertions involving existence, rights and obligations, completeness, presentation, and disclosure. It can also matter when assessing fraud risk.
A company could report substantial cash while simultaneously having borrowing arrangements or restrictions that materially change how that cash should be understood.
The fifth lesson: exceptions should create questions
Suppose the client’s records show $15 million. The confirmation shows $14.2 million. The difference might be a timing issue. It might also be something else.
AS 2310 requires auditors to evaluate confirmation exceptions and determine whether they indicate a misstatement, a deficiency in internal control over financial reporting, or both.
That requires more than mechanically matching numbers. The auditor should understand the nature of the difference.
Was a transfer recorded on one side but not the other? Was an account omitted? Was cash restricted? Was an overdraft presented incorrectly? Was an item recorded in the wrong period? Does the difference suggest a broader problem with the client’s cash controls?
A reconciliation can explain a difference. It cannot replace the auditor’s evaluation of the cause. This is where professional skepticism becomes practical rather than theoretical.
The sixth lesson: a nonresponse is not a conclusion
Banks do not always respond immediately. There may be administrative delays. There may be incorrect contact information. A request may reach the wrong department. A confirming party may be unable or unwilling to respond.
None of these circumstances automatically indicates a misstatement.
But none eliminates the auditor’s responsibility to obtain sufficient appropriate evidence.
AS 2310 requires follow-up on nonresponses to positive confirmations. If a response remains unavailable or incomplete, the auditor should perform appropriate alternative procedures.
For cash, the standard provides a particularly relevant example: the auditor may verify information about the company’s cash account by directly viewing the information maintained in a financial institution’s secure information system.
The important principle is broader than the technology used. When confirmation fails, the auditor needs another source of relevant and reliable evidence. The answer should not simply be another document generated by the client.
The global principle is consistent
U.S. requirements are evolving, but the underlying audit principle is not uniquely American.
ISA 505, External Confirmations, addresses the auditor’s use of external confirmations to obtain relevant and reliable audit evidence. The IAASB’s work on the standard also recognizes a central problem: external confirmations are not automatically reliable simply because they originate outside the entity.
That makes confirmation risk a global audit issue.
The terminology may differ between jurisdictions. The underlying questions remain familiar:
- Who provided the evidence?
- How was it obtained?
- Can the source be trusted?
- Was the process controlled?
- Does the evidence address the relevant assertion?
- Does contradictory evidence require the auditor to reassess risk?
For multinational audit teams, those questions provide a more useful framework than treating confirmation as a jurisdiction-specific checklist.
What CPAs should ask when a cash confirmation fails
A failed confirmation should lead the engagement team through a structured assessment:
- Was the confirming institution independently identified?
- Was the request sent directly to the appropriate confirming party?
- Did the auditor maintain control of the process?
- Did the response come directly from the confirming party?
- Can the identity and authority of the respondent be established?
- Are there unexplained confirmation exceptions?
- Are other bank relationships relevant to the audit?
- Does the failure affect the assessed risk of material misstatement or fraud?
- Were appropriate alternative procedures performed?
- Does the combined evidence support the relevant financial statement assertions?
These questions move confirmation away from administration and back toward its real purpose: obtaining audit evidence.
The real lesson is not about failed confirmations
The strongest cash audit is not the one with the highest response rate. It is the one with the strongest evidence.
A confirmation can fail because a bank does not respond. It can fail because the response is unreliable. It can fail because the auditor did not control the process. It can fail because an exception reveals a deeper issue.
Each failure provides information. The auditor’s job is to use it.
For CPAs, that means treating cash confirmation as part of a broader evidence strategy rather than as a box to tick at year-end. Independent sources, controlled workflows, appropriate alternative procedures, documented evaluation, and professional skepticism all contribute to a defensible conclusion. That is where technology can help.
AuditConfirm gives audit teams a more controlled and traceable way to manage confirmation workflows while keeping the focus on what matters: obtaining reliable evidence from the appropriate external source.
The objective has not changed. Confirm the evidence. Challenge the exceptions. Follow the risk.
FAQs
What should auditors do when a bank does not respond to a cash confirmation?
Auditors should follow up and, if necessary, perform appropriate alternative procedures to obtain sufficient appropriate audit evidence.
Does a confirmation response prove that a cash balance is correct?
No. Auditors must evaluate the source, reliability, exceptions, and other supporting evidence before reaching a conclusion on the cash balance.
Why is auditor control important in cash confirmations?
Auditor control reduces the risk that confirmation requests or responses are intercepted, altered, or routed through the client.
What should auditors do when a cash confirmation contains an exception?
They should investigate the difference and determine whether it indicates a misstatement, control deficiency, or other audit risk.
Can electronic cash confirmations be used as audit evidence?
Yes. Electronic confirmations can provide reliable evidence when the auditor can establish the identity of the confirming party and the integrity of the confirmation process.