Audit Confirmation Article Falls Short

As an auditor by training, I was excited to see the article on improving the confirmation process (“Better Evidence Gathering ,” April 08, page 32). The opening paragraphs rightfully acknowledged that many budgets are blown because of time spent chasing confirmation letters until the eleventh hour— usually taking four to six weeks to be returned if they come back at all—so I anticipated a discussion on improving turnaround times, response rates and the overall confirmation process.

Coming out of busy season, having once again chased paper confirmations until we’re blue in the face with frustration (one definition of insanity is continuing to do things the same way while expecting different results), this was the perfect opportunity to present the latest tools and guidance on confirmations, especially in light of the fact that 2007 provided the first significant updated guidance on confirmations in the 16 years since AU 330 was published.

When AU 330 was released in 1991 there were no electronic audit files, no laptops; the Internet was still known as ARPANET; our professional standards did not acknowledge our responsibility to identify fraud (the word “fraud” did not appear in our standards until 2002 with SAS no. 99); and we had not been hit with the confirmation frauds of Parmalat, Refco (twice), Ahold, Kmart, CF Foods, SafeScript, and, most recently, Take-Two, among others. In 2007, all the following took place:

March 2007—AITF issues Interpretation No. 1 of AU 330 allowing for properly controlled electronic confirmations.

June 2007—PITF’s sole revision to Practice Alert 2003-1, Confirmations , was the additional language allowing for properly controlled electronic confirmations.

 October 2007—IAASB issues exposure draft of ISA 505 (Revised and Redrafted), External Confirmations , updating the definition of a confirmation to include electronic confirmations.

 October 2007—PCAOB names confirmations as a Top Priority.

 October 2007—The ASB commissions a task force to draft a revised AU 330, The Confirmation Process .

 December 2007—60% of the top 50 U.S. banks have adopted secure electronic confirmations.

With the events and changes since 1991, I expected an evaluation of the recent confirmation frauds and a discussion on the impact of the newly released and proposed guidance coupled with an in-depth evaluation of confirmation technologies available. What technology should or shouldn’t we use? What is a “properly controlled” electronic confirmation? How do we evaluate the options with the goal to stop chasing paper and to reduce the chances that a fraud goes undetected?

Additionally, the latest research shows that failure to uncover fraud involving confirmations is often because we rely on the client to tell us whom to send the confirmation to without validating that information (which is a focal point in the IAASB exposure draft comment letters). So, I expected to read about the latest techniques and criteria used to validate whom we send the confirmation to before the confirmation is sent out and what tools are available to help us efficiently do this.

C. Brian Fox, CPA
Nashville, Tenn.


Year-end tax planning and what’s new for 2016

Practitioners need to consider several tax planning opportunities to review with their clients before the end of the year. This report offers strategies for individuals and businesses, as well as recent federal tax law changes affecting this year’s tax returns.


News quiz: Retirement planning, tax practice, and fraud risk

Recent reports focused on a survey that gauges the worries about retirement among CPA financial planners’ clients, a suit that affects tax practitioners, and a guide that offers advice on fraud risk. See how much you know with this short quiz.


Bolster your data defenses

As you weather the dog days of summer, it’s a good time to make sure your cybersecurity structure can stand up to the heat of external and internal threats. Here are six steps to help shore up your systems.