Audit Confirmation Article Falls Short
As an auditor by training, I was excited to see the article on improving the confirmation process (“Better Evidence Gathering ,” April 08, page 32). The opening paragraphs rightfully acknowledged that many budgets are blown because of time spent chasing confirmation letters until the eleventh hour— usually taking four to six weeks to be returned if they come back at all—so I anticipated a discussion on improving turnaround times, response rates and the overall confirmation process.
Coming out of busy season, having once again chased paper confirmations until we’re blue in the face with frustration (one definition of insanity is continuing to do things the same way while expecting different results), this was the perfect opportunity to present the latest tools and guidance on confirmations, especially in light of the fact that 2007 provided the first significant updated guidance on confirmations in the 16 years since AU 330 was published.
When AU 330 was released in 1991 there were no electronic audit files, no laptops; the Internet was still known as ARPANET; our professional standards did not acknowledge our responsibility to identify fraud (the word “fraud” did not appear in our standards until 2002 with SAS no. 99); and we had not been hit with the confirmation frauds of Parmalat, Refco (twice), Ahold, Kmart, CF Foods, SafeScript, and, most recently, Take-Two, among others. In 2007, all the following took place:
March 2007—AITF issues Interpretation No. 1 of AU 330 allowing for properly controlled electronic confirmations.
June 2007—PITF’s sole revision to Practice Alert 2003-1, Confirmations , was the additional language allowing for properly controlled electronic confirmations.
October 2007—IAASB issues exposure draft of ISA 505 (Revised and Redrafted), External Confirmations , updating the definition of a confirmation to include electronic confirmations.
October 2007—PCAOB names confirmations as a Top Priority.
October 2007—The ASB commissions a task force to draft a revised AU 330, The Confirmation Process .
December 2007—60% of the top 50 U.S. banks have adopted secure electronic confirmations.
With the events and changes since 1991, I expected an evaluation of the recent confirmation frauds and a discussion on the impact of the newly released and proposed guidance coupled with an in-depth evaluation of confirmation technologies available. What technology should or shouldn’t we use? What is a “properly controlled” electronic confirmation? How do we evaluate the options with the goal to stop chasing paper and to reduce the chances that a fraud goes undetected?
Additionally, the latest research shows that failure to uncover fraud involving confirmations is often because we rely on the client to tell us whom to send the confirmation to without validating that information (which is a focal point in the IAASB exposure draft comment letters). So, I expected to read about the latest techniques and criteria used to validate whom we send the confirmation to before the confirmation is sent out and what tools are available to help us efficiently do this.
C. Brian Fox, CPA
Nashville, Tenn.
