The single biggest mistake candidates make with external confirmations isn't mixing up positive and negative types. It’s misjudging what a non-response to a positive confirmation actually means for audit risk—it’s not neutral silence, it’s a complete absence of evidence that demands immediate action. The AICPA uses this exact scenario to separate candidates who memorize rules from those who can exercise professional judgment under pressure.
External confirmations are audit evidence obtained as a direct written response to the auditor from a third party. For the CPA AUD exam, mastery means knowing when to use positive vs. negative forms, executing mandatory alternative procedures for non-responses, and evaluating the reliability of evidence for assertions like existence and valuation.
Key facts
- Official guidance: AU-C Section 505, External Confirmations, and AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks.
- Exam section: Auditing and Attestation (AUD).
- Core concept: Obtaining direct written evidence from third parties to corroborate financial statement assertions.
- Primary use: Confirming existence and valuation of accounts receivable, cash balances, and terms of debt.
- Exam format: Tested in both Multiple-Choice Questions (MCQs) and Task-Based Simulations (TBS).
- Official body: American Institute of Certified Public Accountants (AICPA).
Why Do External Confirmations Matter on the CPA Exam?
External confirmations matter on the exam because they are a primary test of your ability to gather and evaluate high-quality audit evidence, a fundamental skill for any auditor. The AICPA uses this topic to assess your professional skepticism and judgment, not just your ability to recall definitions from AU-C 505. Questions will push you beyond the basics to analyze scenarios involving unreturned requests, disputed balances, and questionable responses, forcing you to think like a practitioner.
You won't just be asked to define a positive confirmation. You'll get a task-based simulation with a list of customer responses—some agree, some dispute amounts, and some are silent. Your job is to determine the next step for each, assess the risk, and decide if you have gathered sufficient appropriate audit evidence. This is especially critical when there's a heightened risk of fraud, as confirmations can be a powerful tool for detecting fictitious revenues or customers.
Studying for CPA AUD? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
A common trap is treating all confirmations equally. The exam will test your understanding of the reliability hierarchy. Evidence obtained directly by the auditor from an independent external source is the gold standard. Mastering confirmations means you understand how to achieve that standard and what to do when you fall short. You can practice these complex judgment calls with VoraPrep's adaptive learning engine, which presents you with exam-like scenarios and detailed rationale.
What Are the Key Rules for External Confirmations?
To master this topic, you need to understand the specific rules governing reliability, the distinct uses of positive and negative forms, the requirements for accounts receivable, and the mandatory follow-up procedures.
The Reliability of Audit Evidence (AU-C 505)
The reliability of evidence from confirmations is directly influenced by the auditor's control over the process. As outlined in AU-C 505.A10-.A11, key factors include the auditor's direct involvement in selecting the confirming party, designing the request, and receiving the response. The competence, objectivity, and independence of the third party are also critical. A response from a knowledgeable, independent party provides far more persuasive evidence than one from a related party or someone without direct knowledge of the information being confirmed.
Positive vs. Negative Confirmations: A Direct Comparison
The distinction between positive and negative confirmations is a frequent source of exam questions. Misunderstanding when to use each type can cost you valuable points.
| Feature | Positive Confirmation | Negative Confirmation |
|---|---|---|
| Definition | Asks the third party to respond directly to the auditor, indicating whether they agree or disagree with the information. | Asks the third party to respond only if they disagree with the information provided. |
| Reliability | High. Provides explicit evidence because a response is required. A non-response indicates a lack of evidence. | Low. Provides less persuasive evidence because a non-response is assumed to be an agreement, which may not be true. |
| When to Use | Required for large individual balances, when fraud risk is high, or when internal controls are weak. | Only appropriate when all four conditions are met: low risk of misstatement, a large number of small balances, a very low exception rate is expected, and the auditor has no reason to believe recipients will ignore the request. |
| Action on Non-Response | Alternative procedures are mandatory. The auditor must obtain evidence through other means. | No action is required. The auditor assumes the balance is correct, which is why this method is risky. |
When Are Accounts Receivable Confirmations Required?
Auditors should use external confirmations for accounts receivable unless one of three specific conditions outlined in AU-C 330.20 is met:
- The overall account balance is immaterial.
- External confirmations would be ineffective (e.g., based on prior years' low response rates).
- The auditor’s assessed risk of material misstatement is low, and other planned substantive procedures will reduce audit risk to an acceptably low level.
If you decide not to confirm accounts receivable for a material balance, you must document your reasoning in the audit workpapers. This is a significant judgment call that the exam loves to test.
What Are Proper Alternative Procedures?
When a positive confirmation request is not returned, the auditor must perform alternative procedures. This is non-negotiable. For accounts receivable, the most common alternative procedures are:
- Examining subsequent cash receipts: This involves tracing payments received from the customer after year-end back to the specific invoices that were outstanding on the balance sheet date. This provides strong evidence of existence.
- Reviewing shipping documents and sales invoices: Examining documents like bills of lading can verify that goods were shipped to the customer before the period's end, supporting the occurrence of the sale.
- Inspecting other client correspondence: Reviewing emails or other communications with the customer may provide evidence about the outstanding balance.
Remember, oral responses are not sufficient. If a customer calls to confirm a balance, the auditor must request a written response or perform other procedures to corroborate the information.
Check Your State’s Exact CPA Exam Requirements
Every state has different credit hour, ethics, and residency rules. Use our 55-jurisdiction checker to verify your eligibility before applying.
Worked Example: Navigating a Confirmation Scenario
Let's walk through a realistic TBS-style problem for "Vertex Innovations Inc.," a nonissuer client with a December 31, 2026, year-end. You sent 100 positive confirmations for the largest accounts receivable, totaling $1,200,000 (70% of total AR).
The Situation:- 70 responses were received, all agreeing.
- 20 confirmations were returned as "undeliverable."
- 10 confirmations received no response at all.
- One response from "Tech Solutions Corp." confirmed a balance of $150,000 but noted, "Our records show $120,000, as we returned $30,000 of defective goods on Dec. 28, 2026." Vertex didn't record this return until Jan. 5, 2027.
- Categorize the results and identify the risks.
- 70 agreeing responses: Excellent. This provides strong, direct evidence for those balances.
- 20 undeliverable: These are effectively non-responses and a potential red flag. It could indicate poor record-keeping or even fictitious customers.
- 10 no response: These provide zero evidence. You cannot assume they are correct.
- 1 Tech Solutions exception: This is a known difference that must be investigated. It points directly to a potential cutoff error.
- Formulate a plan for each category.
- For the 20 undeliverable:
- Action: Verify the addresses with the client and attempt to resend. If still unsuccessful, these 20 accounts must be subjected to alternative procedures.
- Judgment: This finding increases the assessed risk of material misstatement for the existence assertion.
- For the 10 non-responses:
- Action: Immediately begin alternative procedures. This is not optional.
- Decision Tree:
- Condition: Positive confirmation, no response.
- Threshold: The balances are material by definition (they were selected as the largest).
- Action: For each of the 10 accounts, examine subsequent cash receipts, shipping documents, and sales invoices.
- For the Tech Solutions discrepancy:
- Action: Investigate the $30,000 difference. Examine Vertex's receiving reports for Dec. 28-31. Review the credit memo issued in January.
- Judgment: The facts strongly suggest a cutoff error. The $30,000 sale and related receivable are likely overstated at year-end. An audit adjustment is probably necessary. You must also consider if this is an isolated incident or a systemic problem with their return process.
- Synthesize the overall conclusion.
- You have a total of 30 accounts (20 undeliverable + 10 no response) for which you currently have no evidence. The results of your alternative procedures on these balances are critical.
- You have one identified misstatement of $30,000. You need to project this error to the entire population and evaluate its impact on materiality.
- The combination of undeliverable addresses and a cutoff error should heighten your professional skepticism regarding revenue recognition.
A common wrong answer on the exam would be to conclude that since 70% of the confirmations came back clean, the issues with the other 30% are likely insignificant. This is a failure of professional judgment. For positive confirmations, silence is not consent. Each non-response represents a gap in your audit evidence that must be filled by alternative procedures before you can conclude on the fairness of the overall accounts receivable balance.
How Will External Confirmations Be Tested on Exam Day?
To pass, you must apply these concepts to varied scenarios. VoraPrep offers over 9,500 practice questions, including many focused specifically on external confirmations, with detailed explanations that teach you the why behind every answer.
Here are three sample MCQs to test your judgment:
Sample Q1: An auditor is planning the accounts receivable confirmation process for a nonissuer client. Which of the following conditions would make positive confirmations the most appropriate choice?- Correct Answer: C. Positive confirmations are the best choice for a small number of high-value accounts, as each balance is individually significant. Furthermore, concerns about internal controls increase the risk of material misstatement, demanding the more persuasive evidence provided by a positive confirmation.
- Why others are wrong:
- A and B describe conditions where less-persuasive negative confirmations might be considered.
- D is one of the four required conditions for using negative confirmations; it doesn't, by itself, make positive confirmations the most appropriate choice.
- Correct Answer: C. A non-response to a positive confirmation provides no audit evidence. Per AU-C 505, the auditor must perform alternative procedures to obtain sufficient appropriate evidence for the assertion being tested.
- Why others are wrong:
- A is the classic exam trap. Silence is not evidence for a positive confirmation.
- B is incorrect. There is no evidence yet that the account is uncollectible.
- D is inappropriate. Switching to a less reliable method after a more reliable one fails is illogical and does not satisfy the need for evidence.
- Correct Answer: B. An oral response does not meet the definition of an external confirmation, which requires a direct written response. The auditor must obtain written evidence, either by asking the vendor to return the confirmation or by performing alternative procedures.
- Why others are wrong:
- A is incorrect because oral evidence is not considered sufficient for this purpose.
- C is incorrect for the same reason as A.
- D is a possible alternative procedure, but obtaining direct written evidence from the third party (B) is the preferred next step.
Ready to test your judgment? Practice all External Confirmations questions in VoraPrep and use our detailed explanations to build the skills you need to pass.
How to Prepare for Confirmation Questions
Success on this topic comes from applying rules, not just listing them.
- Focus on the Decision Points: Don't just memorize the four rules for negative confirmations. Understand why those four rules combined create a low-risk environment. For AR, know the three exceptions to confirming so well you can apply them to a scenario instantly.
- Connect Confirmations to the Big Picture: This isn't an isolated topic. It's a key substantive procedure directly linked to your risk assessment and evaluation of controls. When you find exceptions, it may require you to make required communications to management or the audit committee.
- Drill the "What's Next?" Question: For every practice question, ask yourself, "What would I do next?" If a confirmation is undeliverable, what's the next step? If a customer notes a discrepancy, what's the next step? This forward-looking thinking is exactly what the exam tests.
In your final review week, create a one-page summary sheet covering:
- The decision tree for confirming accounts receivable.
- The four conditions for using negative confirmations.
- A list of at least three alternative procedures for AR.
- The auditor's course of action for handling exceptions.
Frequently asked questions
How many questions on external confirmations appear on the CPA exam?
You can expect several multiple-choice questions and potential integration into a task-based simulation on the AUD exam. While the exact number varies, external confirmations are a foundational audit procedure and are tested frequently, often as part of broader questions on substantive testing and audit evidence.What is the best way to study external confirmations?
The best way is to first understand the rules in AU-C 505 and AU-C 330, then immediately apply them by working through dozens of practice MCQs and simulations. Focus on the explanations for incorrect answers to learn the common traps and nuances the exam writers use to test professional judgment.Are external confirmations tested in simulations (TBS) or only MCQs?
External confirmations are tested in both formats. MCQs typically test your knowledge of the rules and when to apply them, while a TBS will likely provide a set of documents (like confirmation responses) and require you to evaluate the results, identify misstatements, and determine the necessary follow-up procedures.What is the difference between an exception and a non-response?
A non-response is a failure to obtain a reply from a confirmation request, which provides no audit evidence. An exception is a response that indicates a difference between the information in the entity's records and the information from the confirming party, which provides evidence that must be investigated.--- Ready to Pass Your CPA Exam? VoraPrep's adaptive learning engine targets your weak areas, ensuring efficient study, and our Vory tutor is available 24/7 for instant support. With over 9,500 practice questions, you'll be fully prepared. Visit voraprep.com to get started. Start Your Free 14-Day Trial at voraprep.com →