By Bhavesh Dhupelia, Shabbir Readymadewala, Chartered Accountants
fiogf49gjkf0d
Audit evidence is considered to be more reliable when obtained in a documented form directly by the auditor from sources independent of the entity being audited. The higher the auditors’ assessment of risk of material misstatement (including risk of fraud or error), the greater would be the need to obtain persuasive evidence to address those risks. Unless, there exists reasons to conclude otherwise, the auditor would usually place a higher reliance on evidence obtained directly from third parties or corroborating evidence obtained from independent sources. SA 505 provides guidance on the auditor’s use of external confirmation procedures to obtain audit evidence.
‘External confirmations’ is a process of obtaining audit evidence through direct written communication from a third party in response to a request for information about a particular financial item in the financial statements. For certain financial captions, circularising and obtaining independent external confirmations, is one of the most reliable substantive audit procedures, to assist auditors to obtain sufficient appropriate audit evidence to validate the assertion of ‘existence’. Robust confirmation procedures can also serve as an effective tool to respond to fraud risks.
Confirmation requests are generally of two types:
a. Positive confirmation request—through this request, the confirming party responds directly to the auditor indicating whether the party agrees or disagrees with the information requested, or providing the requested information.
b. Negative confirmation request—the confirming party responds directly to the auditor only if the confirming party disagrees with the information provided in the request.
Usually, negative confirmations are used where there are a large number of small balances and the risk of material misstatement is assessed as low. A good example where negative confirmation can be used is for confirming vendor registration status under the Micro, Small and Medium Enterprises Development Act, 2006 (MSMED Act, 2006). Negative confirmation requests may be sent to vendors requesting them to confirm within a stipulated time, whether they are registered enterprises under the MSMED Act, 2006, failing which these would be considered as ‘nonregistered’ enterprises. Where detection risk is high, or the materiality of the account balance is high, positive confirmation will be needed to provide substantive evidence.
In common parlance, external confirmations are understood to be restricted to only bank balances, accounts receivables and payables. External confirmations could also be circularised for investments, borrowings, related party transactions, inventory in custody of third parties, loans and advances, property title deeds mortgaged, guarantees, contingent items, litigation and claims or items that are significant or outside the normal course of business.
External confirmations may also be used to confirm terms of agreements, contracts, or transactions between an entity and other parties or the absence thereof. For example, a request for confirmation of bank balances could also include the bank to confirm whether there exists any other exposure in respect of any other facilities availed by the enterprise. These could be in the nature of letters of credit, derivative contracts, forward contracts outstanding, bank guarantees provided, etc. All these could have implications for accounting and/or disclosures in the financial statements.
Generally, enterprises from whom external confirmation is sought are likely to be independent, ensuring that the evidence is reliable. However, the auditor needs to exercise greater professional scepticism and diligence in cases of related parties or where the confirming party might be economically dependent on the entity.
General reluctance to confirm is more likely due to misunderstanding of the purpose of the request. Debtors may misinterpret the confirmation as a demand for payment. Other parties may fear that confirmation might be binding if they should subsequently discover an error in their own records. Some respondents disclaim responsibility should their response be in error. This is usually the case with bank confirmations. However, this does not necessarily compromise the reliability of the confirmation. It is also pertinent to note that confirming parties may be more likely to respond indicating their disagreement with a confirmation request when the information in the request is not in their favour, and less likely to respond otherwise.
It is interesting to note that SA 505 provides guidance on audit procedures to be followed where an enterprise uses a third party to co-ordinate and provide responses to confirmation requests. Though not prevalent in India, this is a practice widely used in the US. In fact, certain financial institutions including banks in the US have taken the position not to respond to confirmation requests that are mailed or faxed, but accept audit confirmation requests sent only through Capital Confirmation, Inc. (CCI or Confirmation.com), a third party service provider which provides secure electronic confirmation services for auditors and their shared clients. The auditor in such cases would need to consider controls over the information sent by the entity to the service provider, the controls applied on processing of the data and controls over preparation and sending of the confirmation response to the auditor.
Let us now examine the practical application of SA 505 with a case study.
Case Study
ABC Limited is in the business of manufacturing and selling of chemical products. Sales are made to various dealers across the country. The usual credit period is 90 days. The sales for the year ended 31st March 20X0 aggregated Rs. 200 crore and debtors as at 31st March 20X0 amounted to Rs. 75 crore. The debtors listing comprised 350 customers. The management does not follow the practice of obtaining balance confirmations from its debtors.
The auditors of ABC are M/s. PQR & Co (PQR).Roger Smith, Assistant Manager with PQR, was the audit in-charge posted at ABC for the yearend audit. Roger selected 30 high value debtors having debit balances aggregating to Rs. 25 crore for circularisation. In respect of one customer – Genuine Chemicals Limited (GCL), from whom the outstanding was Rs. 10 crore (a material amount outstanding beyond the due date), the management refused to allow Roger to send the confirmation request as the management represented that currently there were ongoing negotiations with GCL, the resolution of which would get impacted by an untimely confirmation request. The mailing addresses for 27 parties were obtained by Roger from ABC’s sales account manager. Since the audit was currently under progress and Roger was posted at ABC’s office premises, Roger decided to courier the physical letters through the courier agency whose services were usually availed by ABC. The proof of dispatch (POD) had to be retained by the dispatch section of ABC as supporting evidence for payment of courier charges billed by the agency. The sales manager informed Roger that in respect of the remaining 2 parties, the business operations had moved to a new location and the new mailing address was not available. Hence for these parties, he requested that e-mails be sent by Roger for balance confirmation which were sent accordingly. For both the physical and the e-mail confirmation requests, the confirmation format used was as prescribed in PQR’s audit documentation standard. Further, return self-addressed envelopes were also enclosed with the physical confirmations couriered. Roger maintained a photocopy of all the confirmation requests circularised.
The debtors ledger for the year ended 31st March 20X0 was finalised by 10th April 20X0 and confirmations were sent by Roger on 15th April 20X0. The accounts were to be cleared by 5th May 20X0 as the board meeting to approve the accounts was scheduled for 10th May 20X0.
Responses were received from only 6 debtors (out of 29 circularised) as per details below.
On enquiry with the sales account manager, Roger was explained that even in the past when balances were circularised, the response received was abysmal. The customer pattern of ABC comprised a large pool of customers with small value balances. As such, the circularisation was not done with adequate rigour. Further, given the short time period between the date of circularisation and the date of accounts finalisation, the sales account manager informed that it was quite likely that some responses could be received post audit closure. For customers from whom no response was received, Roger verified subsequent payments, to the extent these were received until the date of audit. For customers from whom responses were received, Roger compared the confirmations received with the photocopies that he had retained in his file. He believed that the confirmations were in order. In respect of amount due to Genuine Chemicals Limited, Roger felt that given the sensitivity surrounding the pending negotiations, it would be appropriate not to send a confirmation request. Roger concluded on the work paper file that adequate work was done to comply with the requirements of SA505. Was Roger right in his conclusion?
Case Study analysis with the requirements of SA 505.
Design and dispatch of confirmation requests
• There was no management’s authorisation or encouragement to the customers selected for confirmation to respond to PQR’s request. Response rate to confirmation requests sent by auditors, particularly in case of debtors, is to a large extent driven by management’s intent and the degree of follow-up.
• Only high value positive balances were selected for circularisation. Roger should have built in an element of unpredictability by selecting even credit balances, if any, in the sample. Further, some debtors with low value amounts could also have been selected.
• For circularising balance confirmation in respect of Genuine Chemicals Limited, the management’s refusal to send a confirmation request should have been a trigger to evaluate its implication on the assessment of risk of material misstatement, including risk of fraud and whether such a refusal results in a scope limitation. Roger should have corroborated the explanations provided by the management by examining correspondence, if any, that ABC had with the customer evidencing the impending negotiations. He should have by enquiry or by performing procedures such as verifying lawyers’ confirmations/invoices deduced whether any legal case was filed against Genuine Chemicals. Further, given that the amount was material and outstanding beyond the due date, the auditor should have determined the implication of the non-recovery on the financial statements as well as on the audit opinion. This would also need to be communicated to those charged with governance at ABC.
• SA 505 requires the auditor to determine that the requests are properly addressed including testing the validity of some or all of the addresses on confirmation requests before these are sent out. Roger merely took the addresses as furnished by the sales account manager and did not perform procedures to verify the authenticity of the addresses provided.
• It is pertinent to note that for administrative convenience, the courier agency usually employed by ABC was used by the auditor. SA 505 stipulates that the auditor needs to maintain control over confirmation requests sent. Use of client courier may preclude maintenance of independence and control over requests sent. Where the requests are sent under the control of the auditor, he is better positioned to track the status of deliveries. As the client courier was used, proof of dispatches and deliveries was not maintained as evidence of circularisation. Reputed courier enterprises provide an online-tracking status of confirmations couriered together with delivery status. Roger should have also enquired into the status of delivery of confirmations couriered and whether there were any undelivered returns.
• The general practice is to circularise confirmations for year-end or quarter-end balances, but given the short period of time available post year-end for audit closure, Roger could have considered circularising confirmations for balances as at 28th February 20X0 in the month of March 20X0 and then performing roll-forward procedures performed from 28th February 20X0 until 31st March 20X0.
• SA 505 mandates the auditor to send out additional confirmation request where a reply to the previous request has not been received. There were no second/third reminders sent by Roger in the instant case.
Results of External Confirmation procedures
Roger compared the original responses received with the photocopies of the confirmations that he had retained in the file to ensure that there were no alterations made to the confirmations sent originally. This was a good verification procedure followed for testing the authenticity of responses.
Now, let us evaluate whether the response received for each of the six confirmation requests were in order.
1 Universal Chemicals
The confirmation had an exception being the difference of Rs. 3 lakh in the amount confirmed. Roger did not merely rely on the explanation provided by the sales account manager that the difference was on account of delay in accounting by Universal Chemicals. He rightly performed additional procedures to corroborate the same. He obtained confirmation over a telephonic call and further backed it up with a reconciliation explaining the difference from the customer. He also tested year-end sales to Universal Chemicals for further corroborative support.
2 Cosmos Traders
The very fact that the revised confirmation did not have any difference as against a difference of Rs. 32 lakh (in the original confirmation) should have lead Roger to use more professional scepticism and consider performing additional work like testing the transactions with Cosmos and understanding the reasons for the difference and how the same was reconciled.
3 Jupiter Chemicals
The confirmation provided was signed by the purchase executive of Jupiter. Roger should have evaluated whether reliance should be placed on the person authorising the confirmation, the purchase executive in this case. Usually depending on the size and set -up of an enterprise, one would expect accounts staff with appropriate authority to authorise the confirmation. Further, the confirmation was delivered at ABC’s address as against PQR’s office. The auditor should have insisted that the confirming party send the confirmation directly to him duly authorised by a person responsible to do so.
4 Neptune Chemicals
The confirmation was provided by Neptune Dye-Stuff, a Neptune Chemicals affiliate, i.e., not by the original intended confirming party. Such a confir-mation should have raised doubts over reliability of the response received. Further, this would also have implications on the auditor’s assessment of risk of material misstatement (including fraud risk) requiring Roger to modify the nature, timing and extent of other planned audit procedures.
5 Star Traders
This response was received electronically through an Internet email account and has a risk of reliability because proof of origin and authority of the respondent may be difficult to establish, and alterations may be difficult to detect. In this case, the confirmation was sent from an Internet e-mail account and not from the own domain of the confirming party. In such instances, it would be difficult to validate/corroborate the identity of the sender. In case of e-mail confirmations, the auditor needs to consider whether the mail was encrypted, signed electronically using digital signatures, and apply procedures to verify website authenticity. The auditor may also telephone the confirming party to determine whether the confirming party did, in fact, send the response.
6 Mars Chemitech Private Limited
Given the fact that MCPL has been making losses, Roger should have applied greater professional scepticism in evaluating MCPL’s ability to pay the debtor balance due rather than mere reliance on the confirmation provided by it directly.
Roger should have performed adequate alternate audit procedures to mitigate the risk of low response. Fewer responses to confirmation requests than anticipated may indicate a previously unidentified fraud risk factor that requires evaluation in accordance with SA 240.
Concluding remarks
One of the prominent reasons for genesis of frauds which corporate India has witnessed is the ineffectiveness in implementation of external confirmation procedures.
Obtaining external confirmations is a basic audit procedure which has been in audit theory for years but has not been practiced with the rigor that it deserves. To a large extent, the success of these procedures is driven by management’s rigour and follow -up with the confirming party to respond to the auditor which brings back the question of management’s intention to reflect a true and fair position of the enterprise’s affairs. SA 505 sets out the procedures that need to be performed for external confirmations to be an effective audit procedure which auditors should bear in mind while discharging their duties.
