Bank statements play an important role in practically any audit process. Bank statements provide independent evidence of cash activity and balances during the audit period. Despite that, the audit of bank statements is perceived as a procedural task \u2013 just something to tick off the list, instead of an investigation. That approach can weaken audit quality. <\/p>\n\n\n\n
The risks associated with weak cash auditing procedures are significant. As indicated by ACFE’s Occupational Fraud 2024: A Report to the Nations<\/a> \u2013 the largest research on occupational fraud ever performed \u2013 a regular company loses 5% of its annual income due to fraud. Asset misappropriation, including both cash theft and cash account manipulation, accounts for 89% of all reported fraud cases, with a median loss per case of $120,000. If we are talking about financial statement fraud, the median loss is up to $766,000.<\/p>\n\n\n\n For accounting firms handling large-scale audits \u2013 whether for private enterprises, NGOs, or governments \u2013 a proper framework for bank statement review becomes imperative. It is what distinguishes sound audit conclusions from those that are unsubstantiated.<\/p>\n\n\n\n This blog guides you, step-by-step, on how accounting firms audit bank statements. It describes the requirements stated by the standards, what good firms actually do, and where the process tends to break down. A general ledger can be manipulated. Journal entries can be altered after the fact. Account balances can be restated.<\/p>\n\n\n\n Bank statements and bank confirmations<\/a> obtained directly from financial institutions are generally considered more reliable than internally generated client records because they originate from independent external sources. That is why auditors treat them as an independent corroboration tool rather than just a supporting document.<\/p>\n\n\n\n Under AU-C Section 505<\/a>, auditors are required to design and perform external confirmation procedures when responsive to assessed risks of material misstatement and when confirmations are expected to provide relevant and reliable audit evidence. Cash and cash-equivalent balances are often considered higher-risk areas because of their susceptibility to misappropriation and fraud. <\/p>\n\n\n\n The underlying logic: if the bank says the balance is X and the client says it is Y, something needs to be explained.<\/p>\n\n\n\n For firms conducting audits under International Standards on Auditing, the governing standard is ISA 505<\/a>, issued by the International Auditing and Assurance Standards Board (IAASB). While ISA 505 and AU-C 505 differ in certain procedural requirements, the core principle is identical: confirmation evidence must come directly from the third party to the auditor, not through the client.<\/p>\n\n\n\n No audit procedure stands alone. Before even looking at one bank statement, auditors need to consider where the risk lies in the financial statements. That requires reviewing the client\u2019s internal controls for cash, identifying who is responsible for making payments and performing the reconciliation, and whether those duties are segregated. <\/p>\n\n\n\n It means identifying which accounts are important. A big corporation might have many bank accounts, including operating accounts, payroll accounts, escrow accounts, and foreign-currency accounts. It\u2019s up to the auditor to decide which to test in full, which by analysis, and which aren\u2019t risky.<\/p>\n\n\n\n For registered firms working with US public company clients, PCAOB AS 2310<\/a> governs the confirmation process. PCAOB AS 2301<\/a> provides the broader planning framework, linking the assessment of fraud risks to the design of substantive procedures \u2014 including those involving cash.<\/p>\n\n\n\n Audit teams need to be aware of the standards for the quality of evidence to be collected before they send out confirmation requests. The updated SAS 142<\/a>, which became effective for periods ending on or after December 15, 2022, improved on AU-C 500 and modified how auditors evaluate the sufficiency and appropriateness of audit evidence.<\/p>\n\n\n\n This standard is highly relevant to bank statement verification audits. The new SAS 142 states that the auditor’s role goes beyond simply collecting evidence, since the auditor must evaluate the reliability of the evidence, depending on its source, circumstances, and methods used to collect it. <\/p>\n\n\n\n Bank confirmations sent via a controlled platform are reliable in a manner different from those sent via an uncontrolled email system.<\/p>\n\n\n\n The confirmation process is a central component of substantive cash testing. <\/p>\n\n\n\n The audit confirmation<\/a> letter is sent by the auditor rather than the client, which makes all the difference. Where the client controls the confirmation process, there is no independence of evidence.<\/p>\n\n\n\n A common practice when conducting audits in the United States includes sending confirmation letters to the bank of the client and asking it to verify:<\/p>\n\n\n\n – Balances as at the audit date Standardized bank confirmation forms<\/a>, including those commonly used in AICPA-based engagements, are frequently used in practice. Many companies use online confirmation services, which are much more convenient and secure than paper-based confirmations.\u00a0<\/p>\n\n\n\n To preserve reliability, confirmation responses should be returned directly to the auditor through controlled channels. <\/p>\n\n\n\n Once confirmations are completed, the reconciliation process begins. It is uncommon for a confirmed bank balance to exactly match the corresponding book balance, and such differences are generally expected.<\/p>\n\n\n\n Differences in timing, especially outstanding checks and deposits in transit, explain most of the difference. Nonetheless, the reconciliation still needs to be tested thoroughly.<\/p>\n\n\n\n Auditors look for:<\/strong><\/p>\n\n\n\n Outstanding checks that are suspiciously old:<\/strong> A check outstanding for six months on a reconciliation is a red flag. It may indicate a fraudulent disbursement that was never cashed or a fictitious liability.<\/p>\n\n\n\n Deposits in transit that don’t clear promptly:<\/strong> If a deposit recorded in December doesn’t appear on the January bank statement, that warrants explanation. Lapping \u2014 a form of fraud where funds from one account are used to cover another \u2014 often surfaces here.<\/p>\n\n\n\n Reconciling items that are round numbers:<\/strong> Round-number reconciling items may warrant additional scrutiny because unusual or fabricated transactions can sometimes appear less operationally granular than routine activity. A $10,000 reconciling item deserves more scrutiny than a $9,847.32 one.<\/p>\n\n\n\n Journal entries are made to the cash account near the end of the period.<\/strong> Top-side adjustments to cash accounts without supporting documentation are a consistent indicator of manipulation.<\/p>\n\n\n\n Cut-off testing evaluates whether transactions were recorded in the appropriate accounting period. In relation to the bank statement, this will involve analyzing transactions that occur before and after the balance sheet date. <\/p>\n\n\n\n In most cases, auditors analyze transactions related to the bank account in the last five to ten days of the current accounting period and the first five to ten days of the next accounting period. <\/p>\n\n\n\n This is intended to determine whether any manipulation occurs during the recording of these transactions. It is crucial to confirm and reconcile balances; however, it is not sufficient on its own. As per the bank statement audit process, important transactions should always be backed by supporting documents. <\/p>\n\n\n\n Either invoices or contracts should back transactions above the threshold limit, whereas cash payments should be supported by customer invoices or sales contracts. It may be quite challenging for accounting firms to audit organizations involved in construction, real estate, or finance. <\/p>\n\n\n\n However, there is no other way to ensure that the transactions shown in the bank statement are genuine.<\/p>\n\n\n\n Bank statements frequently reveal transactions that are not apparent in the general ledger. Transfers between related entities, payments to parties with undisclosed relationships, and unusual wire activity all tend to surface here.<\/p>\n\n\n\n Auditors are required under AU-C Section 550<\/a> to evaluate whether related-party transactions are identified, properly authorized, and disclosed in the financial statements.<\/p>\n\n\n\n A wire transfer to an entity not listed on the client’s disclosed related-party schedule requires explanation. So does a pattern of transfers to the same third party around period-end.<\/p>\n\n\n\n Even experienced firms encounter failures in the bank statement audit process. The most common:<\/p>\n\n\n\n Over-reliance on client-prepared reconciliations: <\/strong>Accepting a reconciliation without verifying the underlying transactions constitutes inadequate audit evidence. Reconciliation itself needs to be verified.<\/p>\n\n\n\n Confirmation for accounts other than those known to the auditor: <\/strong>Confirmation requests should specifically ask the bank to disclose any other accounts they may have with the entity during the year, regardless of whether they were opened or closed during the period.<\/p>\n\n\n\n No action taken when no reply from the bank: <\/strong>If confirmation responses are not received, auditors are generally required to perform alternative procedures, such as inspecting subsequent bank statements, reviewing reconciliations, examining canceled checks, or inspecting other supporting bank documentation.<\/p>\n\n\n\n Not testing the completeness of the reconciliation population: <\/strong>An agreement to reconcile items alone is not adequate. Auditors need to verify that all items that should appear on the reconciliation are present.<\/p>\n\n\n\n Treating SAS 142 as merely a documentation exercise: <\/strong>It is necessary to evaluate the reliability of the evidence according to how it was obtained. An unsecured method of obtaining bank confirmation via email would be unreliable compared to a controlled, secure method.<\/p>\n\n\n\n There are many recognized shortcomings associated with the paper confirmation system. Interception, modification, and delay are all valid threats. The use of digital confirmation systems reduces many of these weaknesses by enabling safe, direct communication between the auditor and the financial institution. <\/p>\n\n\n\n The AICPA has already acknowledged the use of electronic confirmation systems provided proper controls are in place, and SAS 142 provides clear guidelines regarding the interpretation of what constitutes \u201cproper controls\u201d when assessing the credibility of electronically obtained evidence. <\/p>\n\n\n\n Many savings are achieved for companies dealing with large numbers of bank confirmations. However, the core audit principle remains unchanged: auditors must maintain control over the confirmation process. <\/p>\n\n\n\n The bank statement audit process for accounting firms involves far more than simply verifying balances. A proper bank statement verification audit evaluates whether reported cash activity is complete, accurate, and supported by reliable external evidence.<\/p>\n\n\n\n When performed correctly, the bank statement audit process helps auditors identify reconciliation issues, detect unusual transactions, uncover potential fraud risks, and strengthen the overall quality of audit evidence supporting the financial statements.<\/p>\n\n\n\n As accounting firms modernize how they audit bank statements, digital confirmation platforms are becoming an increasingly important part of the audit workflow. AuditConfirm<\/a> enables auditors to obtain bank statements and balance confirmations directly from financial institutions while maintaining auditor control over the confirmation process.<\/p>\n\n\n\n By streamlining bank confirmation requests, organizing audit evidence, and supporting secure documentation workflows, AuditConfirm helps make the bank statement audit process for accounting firms more efficient while preserving the professional skepticism and auditor judgment that remain essential throughout the engagement.Note: This blog is informational only and does not constitute audit, accounting, or legal advice. Audit requirements vary depending on the type of engagement, jurisdiction, and standards applicable. Professional standard-setting bodies such as <\/em>AICPA<\/em><\/a>, <\/em>PCAOB<\/em><\/a>, and<\/em> IAASB<\/em><\/a> are good sources for audit standards.<\/em><\/p>\n\n\n\n
<\/p>\n\n\n\nWhy are bank statements audited separately?<\/strong><\/h2>\n\n\n\n
The <\/strong>bank statement audit process<\/strong>: stage by stage<\/strong><\/h2>\n\n\n\n
Stage 1: Planning and risk assessment<\/strong><\/h3>\n\n\n\n
Stage 2: Evaluating evidence under SAS 142<\/strong><\/h3>\n\n\n\n
Stage 3: Requesting bank confirmations<\/strong><\/h3>\n\n\n\n
– Balances and terms of loans
– Lines of credit and collateral
– Contingencies or guarantees
– Accounts that have been closed down<\/p>\n\n\n\nStage 4: Reconciliation of the confirmed balances to the general ledger<\/strong><\/h3>\n\n\n\n
Stage 5: Testing cut-off<\/strong><\/h3>\n\n\n\n
<\/p>\n\n\n\nStage 6: Tracing to supporting documentation<\/strong><\/h3>\n\n\n\n
Stage 7: Evaluating intercompany and related-party transfers<\/strong><\/h3>\n\n\n\n
Where the process most often breaks down<\/strong><\/h2>\n\n\n\n
A note on digital confirmation platforms<\/strong><\/h2>\n\n\n\n
Conclusion<\/strong><\/h2>\n\n\n\n
FAQs<\/h2>\n\n\n\n