The role of confirmations as audit evidence.

Confirmations have long been considered a strong form of evidence by auditors because the procedure involves direct communication with independent sources outside the entity being audited. But the reliability traditionally placed on confirmation evidence may be unjustified. Several studies have condluded such reliance is unfounded. This article reviews the background of the confirmation procedure, focusing on accounts receivable confirmations for illustrative purposes, and presents evidence on accounts receivable confirmation reliability. Suggestions are offered on future use of the confirmation procedure.

AUDITING STANDARDS

ON CONFIRMATIONS

Accounts receivable confirmation was an optional audit procedure in the United States and not widely used before 1938. The massive McKesson--Robbins fraud, undetected for over a decade and involving the recording of fictitious sales, receivables and inventories, came to light in that year. The Securities and Exchange Commission launched a major investigation to determine the adequacy of audit procedures generally in use. The accounting profession responded by issuing Statement on Auditing Procedures (SAP) no. 1, Extensions of Auditing Procedure, which recommended confirmation of receivables "wherever practicable and reasonable."

In the early 1940s, a number of modifications were made to auditing standards involving confirmation. The most significant was SAP no. 12, Amendment to Extensions of Auditing Procedure. Auditors were required to disclose any situation in which confirmation of receivables with debtors was not performed, in effect making confirmation a mandatory procedure. The SAP no. 12 disclosure requirement was rescinded in 1974, but by then confirmation of receivables was an ingrained procedure in U.S. audit practice.

Statement on Auditing Standards no. 67, The Confirmation Process, issued in November 1991, dictates current U.S. audit procedures on confirmations. The statement defines the confirmation process, relates confirmation evidence to risk assessment and financial statement assertions and discusses the positive and negative confirmation forms and the situations in which they can be most helpful. It also discusses the problem of nonresponse to positive-form confirmations and the need to employ alternative procedures "to obtain the evidence necessary to reduce audit risk to an acceptably low level."

The American Institute of CPAs auditing procedure study, Confirmation of Accounts Receivable, issued in 1984, provides additional guidance. The study, which discusses confirmation evidence in terms of financial statement assertions, maintains confirmation is a primary source of evidence regarding the existence assertion and a secondary source of evidence regarding the completeness and valuation assertions. It also contains cautionary advice such as

* The tendency of confirmees to report more of the errors overstating than understating the balance.

* Inaccurate responses and inadequate rates of response.

The study offers suggestions for improving response accuracy and rates, but none addresses or corrects fro confirmees' potential reporting bias, resulting in auditors' finding more accounts receivable overstatement than understatement errors.

WHY CONSIDER CONFIRMATION

RELIABILITY?

Why should the reliability of confirmation evidence be examined? Auditors have long suspected confirmation evidence is biased. According to a Canadian Institute of Chartered Accountants (CICA) 1980 audit technique study, "reliance on a test consisting only of replies means that the test is determined by the responding and non-responding debtors instead of the auditor, and it may no longer be representative or appropriate."

The CICA study also expressed concern with respondent apathy and "say yes" behavior (when customers confirm balances as correct without actually checking their records), which result in unreliable evidence: "The danger of using the communication technique in these circumstances is that the auditor may use it just to conform with professional standards and not to add audit assurance."

The following example illustrates why a study of confirmation reliability is important. Suppose duplicate billing erros occur more frequently than any other accounts receivable error. This means overstatement errors are more prevalent than understatement errors. In this case, the reason the confirmation procedure detects more overstatement errors is simply that mor of them are present and not because of any reporting bias by confirmees.

Confirmation reliability should be studied in a field experiment because

* The experimenter controls the size of the errors.

* The experimenter controls which accounts are seeded with errors.

* The experimenter controls the frequency of overstatement and understatement errors.

* Other factors that may affect reliability can be studied, such as account balance size and age and transaction volume.

* The underlying cause of any reporting bias can be isolated, making corrective action possible.

Thus, confirmation reliability is best assessed under the controls possible in a carefully designed experiment.

PRIOR EVIDENCE ON CONFIRMATION

RELIABILITY

Previous studies assessed the reliability of confirmation evidence by seeding confirmation request forms with errors. Three findins from these studies were of interest:

* Overall rates of detection and reporting of errors to auditors were quite low--generally less than 50%.

* Customers tended to report more errors unfavorable to themselves (overstatements of accounts receivable) than favorable errors (understatements of accounts receivable).

* Detection and reporting of errors generally was better when the positive form of confirmation request was used as compared to the negative form.

These studies were limited in scope due to the populations sampled. Two studies were conducted at university credit unions and three were performed at banks. Few of the confirmees were commercial companies with accounting departments, bookkeepers and accounts payable personnel. Presumably, such companies will have a better rate of error detection.

CONFIRMATION RELIABILITY USING

TRADE ACCOUNTS RECEIVABLE

To obtain further evidence on confirmation reliability, I conducted a field experiment during the annual audit of a steel warehousing operation in New Jersey. The warehouse's customers represented a broad spectrum of industries, and most were small to medium-sized companies located in New York, New Jersey and Pennsylvania.

A few of the customers were quite large and listed in teh Fortune 500. In many respects, the customers, were typical of those found on most manufacturers' audits, providing a "rich" audit environment for the study of confirmation reliability.

All customers with debit balances received positive-form confirmation requests, using the same format as prior years'. Return envelopes were supplied directing all replies to the auditors. Customers were unaware they were involved in an experiment. To test reliability, confirmation request balances were altered for nearly 80% of the accounts. An equal number of overstatement and understatement errors was assigned randomly. In addition, the size of the errors varied: adjustments of plus or minus 20% for large accounts and plus or minus 3% for small ones. The remaining accounts were not seeded with errors, serving as both a control group for the experiment and as the sample the auditors used for their annual audit. Experiment results are summarized in the exhibit on page 76.

Confirmation reliability should be assessed in terms of specific management assertions. Confirmations are the primary source of evidence regarding the existence assertion. In the experiment, approximately two-thirds of the customers replied to the confirmation request, a response rate comparable to that of other years, leaving nearly one-third who failed to reply to first or second requests. Alternative audit procedures were necessary for a significant number of accounts to gain satisfactory evidence of the existence assertion.

Confirmations are a secondary source of evidence regarding the valuation assertion. Yet in the experiment, only 47.2%--less than half of the errors--were detected and reported to the auditors. In most circumstances, use of confirmation evidence to assess error rates results in a severe underestimation of the actual number of errors. In this experiment, reporting bias of the type described in auditing literature was detected: Customers were more likely to report overstatement errors than understatement errors and to detect and report large errors.

Confirmations also are a secondary source of evidence regarding the completeness assertion. Although this experiment was not designed to test completeness directly, less than 42% of large understatement errors were detected and reported to the auditors. Thus, confirmation evidence does not appear to be very strong in terms of completeness.

One other result may affect the reliability of the confirmation procedure. Standard confirmation requests instruct customers to report any exceptions directly to the auditors. In this experiment, nearly 55 of the customers receiving requests with altered balances called the company being audited to investigate exceptions instead of reporting the exceptions directly to the auditors. All these calls were handled by the experimenter, who posed as an accounts receivable clerk for control purposes. Several callers asked specifically what they should write on the confirmation form.

In analyzing the experiment results, I considered several other factors; none were found significant in explaining confirmation response and detection of errors. These factors include account balance age and size and transaction volume. Although account balance age was not significant, there were very few past-due accounts in the population--only 5% of the customers had balances two or more months past due. The response rate for them was only 35%, about half the rate for the rest of the population.

IMPLICATIONS REGARDING USE

OF CONFIRMATIONS

This study raises serious questions about the reliability of the confirmation procdure. Unlike prior studies, the results come from a more suitable audit environment, one based on trade accounts receivable. The following can be concluded regarding specific management assertions about accounts receivable:

* Accounts receivable confirmations are biased as a secondary source of evidence regarding the valuation assertion. Overstatement errors are more likely to be reported to auditors than understatements.

* Accounts receivable confirmations are not very strong as a secondary source of evidence regarding the valuation assertion. Less than half the errors are reported to auditors due to say-yes behavior and response bias.

* Accounts receivable confirmations are not very strong as a secondary source of evidence regarding the completeness assertion. Understatements of accounts receivable are less likely to be reported to auditors.

* Even though accounts receivable confirmations are the primary source of evidence for the existence assertion, much additional audit work is required. Overall response rates are lower than desirable.

Summary results of a field test
of confirmation reliability
Overall rate response                          68.6%
Response rate from significantly past-due
accounts                                       35.3%
Overall rate of error detection                47.2%
Detection of large overstatement errors        53.2%
Detection of large understatement errors       41.9%
Detection of small overstatement errors        46.9%
Detection of small understatement errors       46.7%
Customers receiving requests with errors who
phone the client instead of the auditors       4.6%

SAS no. 67 revises auditing standards to highlight the apparent weaknesses in the confirmation procedure. Reliability is low due to respondent apathy, reporting biases and say-yes behavior. The new standard makes it clear confirmation of accounts receivable is not mandatory. For example, auditors do not have to use confirmations if responses are "known or expected to be unreliable." Despite these shortcomings, the confirmation procedure has one great benefit--the evidence is relatively inexpensive to obtain.

SAS no. 67 provides auditors with a choice of alternative procedures because the cost of performing these procedures will vary depending on a client's cash, accounts receivable and sales systems. For example, at the company where thefield research was performed, it was very easy (and inexpensive) to observe subsequent cash receipts when teh mail arrived and was opened by the client. In these circumstances, a customer's check provides evidence of existence that may be just as reliable as confirmation evidence, and far more reliable in terms of valuation. Shipping documents also may be examined to provide evidence of existence.

ADVICE TO PRACTITIONERS

What can practitioners do to guard against confirmation reliability problems? Greater care must be taken when preparing confirmation requests to ensure the addressee is someone knowledgeable and responsible for the account in question. Auditors should design the confirmation request to encourage response. For example, if the confirmee is known to use a voucher payable system, the confirmation request should be for specific invoices or transactions instead of for the entire balance.

The mere fact a customer confirms a balance is not evidence of collectibility. Subsequent cash receipts and credit reports (where applicable) should be examined to satisfy the valuation assertion. Also, error rates based solely on confirmation evidence should not be projected to the entire accounts receivable populations, due to say-yes behavior and respondents' tendency to report only overstatement errors. Finally, the auditor must maintain professional skepticism regarding confirmation replies, thereby preventing overreliance on confirmation evidence.

PAUL CASTER, CPA, PhD, is assistant professor of accounting at the School of Accounting, University of Southern California, Los Angeles. He is a member of the American Institute of CPAs and the American Accounting Association.