Audit Confirmations (2026): Positive vs. Negative, and What to Do When a Customer Never Replies
Kyle Ashcraft, CPA · 2019 CPA Exam Scores · 95 FAR · 98 BEC · 91 REG · 90 AUD
A confirmation is some of the best evidence an auditor can get. It comes straight from someone outside the company. So the question that matters on the exam is not how to send one. It is what you do when one never comes back.
Here is a full round trip at Coffee Co., the example client from my Auditing 101 videos. Coffee Co. sells coffee beans to restaurants, and on December 31, Year 2, its customers owe it $30,000.
Quick answer: in a positive confirmation the customer replies whether they agree or not. In a negative one they reply only if they disagree, so silence counts as agreement, which is weaker evidence. When a customer does not answer even a second request, you cannot skip the balance. You perform alternative procedures: cash received after year end, and the shipping documents behind the invoices.
This is the confirmation chapter of my Auditing 101 video on what auditors actually do in the field. The page below covers the same round trip in writing.
On this page
Last updated October 2026. Coffee Co. and every figure in it are the example from my Auditing 101 video, not a real client. Standards referenced: AICPA AU-C 505 and PCAOB AS 2310.
Why is a confirmation such strong evidence?
Because the auditor hears from the customer directly. Here is the aging of Coffee Co.'s receivables at December 31, Year 2:
| Customer | Owes | Note |
|---|---|---|
| Bean Street Cafe | $4,000 | |
| Harbor Bakery | $6,000 | Selected |
| Sunrise Diner | $20,000 | Selected; over 90 days old |
| Total receivables | $30,000 | Selected: $26,000 |
Our worry with receivables is that they are overstated, so we want to hear from the customers themselves. I pick Harbor Bakery and Sunrise Diner. That is $26,000 of the $30,000.
How does the confirmation round trip work?
- Coffee Co. prepares the request and signs it, because the customer will not talk to us without the client's permission.
- The auditor takes it, and the auditor mails it. The request does not go back through the client.
- The request tells the customer to reply directly to the auditor. So the reply comes back to us, and Coffee Co. never touches it.
That last point is the whole reason confirmations are strong. If the client could handle the reply, it could change it.
Positive or negative: what is the difference?
| Positive confirmation | Negative confirmation | |
|---|---|---|
| Customer replies | Either way, whether they agree or not | Only if they disagree |
| What silence means | A problem: you follow up | Agreement |
| Strength of evidence | Stronger | Weaker |
I can use negatives alone only when all four of these are true:
- The risk is low.
- There are lots of small, similar balances.
- I expect very few errors.
- I have no reason to think customers will ignore the requests.
And on a public company audit, negative confirmations alone are never enough. PCAOB AS 2310 says negative requests by themselves do not provide sufficient appropriate evidence.
What do you do when a customer replies with a different number?
Both of Coffee Co.'s requests went out on January 6. Here is the confirmation control work paper:
| Customer | Balance | Sent | Reply | Result |
|---|---|---|---|---|
| Harbor Bakery | $6,000 | Jan 6 | Jan 14: owes $4,500 | Exception: $1,500 |
| Sunrise Diner | $20,000 | Jan 6; second request Feb 3 | None | Alternative procedures |
Harbor Bakery replied on January 14, but it says it owes $4,500, not $6,000. That is an exception, so we investigate. Harbor Bakery returned $1,500 of damaged coffee on December 28, and Coffee Co. did not record the credit until January 6. So receivables are overstated by $1,500 at year end, and that goes on our summary of misstatements.
What do you do when a customer never replies?
Sunrise Diner never replied, not even to our second request on February 3. We cannot just skip it. We perform alternative procedures, and we build the support in two pieces.
| Alternative procedure | What we found | Supports |
|---|---|---|
| Cash received after year end | On January 15, Sunrise paid $8,000, and that check pays invoice 12791, one of the invoices in the December 31 balance | $8,000 |
| Documents behind the rest | Invoice 12946 is for $12,000, and the bill of lading shows the coffee shipped to Sunrise Diner on September 26 | $12,000 |
| Total supported | $20,000 | |
The cash proves $8,000 of the balance was real. The other $12,000 is not paid yet, so we go to the documents behind it. If we shipped it, the receivable exists. The full $20,000 is supported.
One limit. A confirmation tests whether a receivable exists. It does not tell you whether Sunrise will pay, and that balance is over 90 days old. Collectibility is a separate question, handled in the allowance.
How does the AUD exam test this?
The question asks what the auditor would most likely do for receivable confirmations when there is no reply to the second request. That is Sunrise Diner.
- Answer D is correct: inspect the shipping records. That is the bill of lading, the documents behind the invoice.
- Answer B is the other way out, and it does not work. It has the auditor intensify the study of the internal control structure for the revenue cycle. The question is whether this one customer's balance exists at year end, and more controls work gives no evidence about one balance. The alternative procedure has to be substantive: the shipping records, or cash received after year end.
- Answer A is the trap. Cash received in December paid off invoices that were already gone by year end. The cash has to come in after year end.
- Answer C is backwards. A missing reply means we need more evidence, so detection risk goes down, not up.
Remember: no reply to the second request means alternative procedures: cash received after year end and the shipping documents. Never cash from before year end, and never "skip it."
For the rest of the receivables audit, see auditing accounts receivable and my Auditing 101 article on substantive testing of cash and receivables.
Sources: AICPA AU-C 505, External Confirmations; PCAOB AS 2310, The Auditor's Use of Confirmation. Standards checked October 2026. Coffee Co. figures are illustrative.
Frequently asked questions
What is the difference between a positive and a negative confirmation?
With a positive confirmation the customer replies whether they agree or not. With a negative confirmation the customer replies only if they disagree, so silence counts as agreement. Negative confirmations are weaker evidence.
Who mails an audit confirmation?
The auditor. The client prepares and signs the request, but the auditor mails it and the customer replies directly to the auditor, so the client never handles the response.
What do you do when a customer does not respond to a confirmation?
Send a second request, and if there is still no reply, perform alternative procedures. For receivables that means looking at cash received after year end and the documents behind the invoices, such as the bill of lading showing the goods shipped.
When can an auditor use negative confirmations alone?
Only when the risk is low, there are many small and similar balances, very few errors are expected, and there is no reason to think customers will ignore the requests. On a public company audit, negative confirmations alone are never enough.
What do you do with a confirmation exception?
Investigate it. If the customer's number is right and the books are wrong, the difference goes on the summary of misstatements. At Coffee Co., Harbor Bakery's $1,500 return was recorded after year end, so receivables were overstated by $1,500.
Start the free AUD 101 course
A full free outline and official AICPA questions you can practice, so you can see whether the explanations work for you. No credit card required.
Kyle Ashcraft, CPA scored 90 or above on every section of the CPA exam in 2019, including a 90 on AUD. He is the founder and sole instructor of Maxwell CPA Review, where he creates every lecture, textbook and study outline himself.
Reach him at MaxwellCPAreview@gmail.com.
Double-click to edit...