How to Know When to Send Bank Confirmations
Should you always send bank confirmations?
Bank confirmations are not a required audit procedure, yet many firms always send them.
Should they?
Here’s my take on this:
1. They should be sent when the risk of material misstatement is high for the existence assertion.
2. They should be sent for any first year audit client or for newly opened bank accounts.
When should the risk of material misstatement be high for the existence assertion? When you believe there is a high probability that the cash account doesn’t exist or the dollar amount is not real.
Cash Accounts and Fraud Risk
Yes, I know, what about fraud risk?
There’s two types of fraud: (1) cooking the books, and (2) theft.
In cooking the books, the threat for assets is overstatement; so, the business could overstate its cash balance to make itself look better than it is. If cash is intentionally overstated, a confirmation might help, but in 40 years of auditing, I’ve never seen a company intentionally overstate cash. (I have seen frauds where deposits in transit were intentionally overstated to cover up theft, but confirmations do not address outstanding items.)
What is the risk that cash is intentionally overstated? Usually, not very high.
Fraud Detection
Can a bank confirmation help in detecting fraud? Absolutely, and I’ve seen this happen in some fraud cases I’ve read about. So, I’m not saying bank confirmations never help. When a fraudster creates fake bank statements, you can have massive fraud, and bank confirmations are needed.
I once taught a class with 75 auditors from all over my state, and I asked, “How many of you have ever detected fraud by sending bank confirmations?” Not one hand went up. I don’t know how many confirmations those folks had sent, but I’d say tens of thousands. (This did not elevate my view of bank confirmations.)
Completeness Assertion
If theft occurs, the completeness assertion is relevant. The cash balance should be higher, but some or all of the money is stolen. A confirmation does not address completeness of the dollar amount (in other words, if cash is stolen, the bank confirmation will simply confirm the balance that remains—not what the cash balance should have been if no theft had occurred).
Bank confirmations could address the completeness of the number of bank accounts if the bank would tell you about all bank accounts, even those not listed on the confirmation. But I have found that most banks will not tell you about accounts not listed on the confirmation.
But what if confirmations are not sent? What alternative procedures are available?
Alternative Cash Procedures
Some auditors don’t send confirmations and tie the bank balance to the client’s bank statements. What’s the danger in doing so? The bank statements provided by your client could be fake. So, examine the statements provided for signs of alteration.
Another procedure used instead of a bank confirmation is viewing online balances. For example, you could have the client log into their bank account and view the balance at the end of the period.
Are these alternative procedures sufficient? It depends on your risk assessments for the relevant cash assertions. The alternative procedures could be okay if these are low to moderate.
Downsides to Not Sending Bank Confirmations
What’s the downside to not sending confirmations?
1. In those rare instances where a company creates fake bank statements, a confirmation is very helpful. If you don’t send them, you will look foolish.
2. If you (the auditor) are sued (e.g., when fraud occurs), the opposing attorney will point out that most auditors send confirmations. This can make your work look deficient.
What do you think? Should you send bank confirmations?
Here’s another article about confirmations.
Here’s my separate article about auditing cash which covers other considerations.
Related
