VSA 505 - External confirmations

VIETNAMESE STANDARDS ON AUDITING

Standard No. 505: External Confirmations

(Issued in pursuance of the Finance Minister’s Decision No. 101/2005/QD-BTC dated 29 December 2005)

I/ GENERAL PROVISIONS 

1. The purpose of this Vietnamese Standard on Auditing (VSA) is to establish standards and provide guidance on the auditor’s use of external confirmation as a means of   obtaining audit evidence of the auditor and the audit firm.
2. The auditor and the audit firm should determine whether the use of external confirmations is necessary to obtain sufficient appropriate audit evidence at the assertion. In making this determination, the auditor should consider the assessed risk of material misstatement, inherent and control risks and how the audit evidence from other planned audit procedures will reduce the risk of material misstatement at the asserion level to an acceptably low level.
   3. The auditor and the audit firm should comply with this VSA in obtaining external confirmations.
   4. It is expected that the audited (client) entity, related entities and persons should possess essential knowledge as to the objective and general principles set out in this VSA in working with the auditor and the audit firm and dealing with the relations maintained during obtaining external confirmation.
   5. VSA 500 Audit Evidence states that the reliability of audit evidence is influenced by its source and by its nature, and is dependent on the individual circumstances under which it is obtained. Under this VSA, audit evidence is more reliable when it is obtained from independent sources outside the entity; and audit evidence is more reliable when it exists in image or documentary form than in oral form. Accordingly, audit evidence in the form of original written from outside is more reliable as people outside the entity are not directly related to the entity being audited. The auditor should determine whether to consider audit evidence individually or cumulatively from other audit procedures which were implemented or will be implemented to assist in reducing the risk of material misstatement for the related assertions to an acceptably low level.
   6. External confirmation is the process of obtaining and evaluating audit evidence through a representation of information or an existing condition directly from a third party in response to a request for information about a particular item affecting management’s assertions disclosed in the financial statements of the entity being audited. In deciding to what extent to use external confirmations the auditor and the audit firm consider the characteristics of the environment in which the entity being audited operates and the collectability of such information.
   7. External confirmations are frequently used in relation to account balances and their components, but need not be restricted to these items. For example, the auditor and the audit firm may request external confirmation of the terms of agreements or transactions an entity has with third parties. Other examples of situations where external confirmations may be used include the following:
      1. Bank balances and other information from bankers;
      2. Accounts receivable balances;
      3. Stocks held by third parties at bonded warehouses for processing or on consignment;
      4. Property title deeds held by lawyers or financiers for safe custody or as security;
      5. Investments purchased from stockbrokers but not delivered at the balance sheet date;
      6. Loans from lenders; and
      7. Accounts payable balances.
8. The reliability of the audit evidence obtained by external confirmations depends, among other factors, upon the auditor applying appropriate audit procedures in designing the external confirmation request, performing the external confirmation procedures, and evaluating the results of the external confirmation procedures. Factors affecting the reliability of confirmations include the control the auditor exercises over confirmation requests and responses, the characteristics of the respondents, and any restrictions included in the response or imposed by management.

CONTENTS OF THE VSA

Relationship of External Confirmation Procedures to the Auditor’s Assessments of the Inherent Risk and Control Risk

9. VSA 400 Risk Assessments and Internal Control specifies audit risk and its components, including inherent risk, control risk and detection risk. This VSA also prescribles that the auditor’s control risk assessment, together with the inherent risk assessment is to influence the nature, timing and extent of substantive procedures to be performed to reduce detection risk, therefore audit risk, to an acceptably low level.
   10. VSA 400 Risk Assessments and Internal Control also specifies the nature and extent of audit evidence obtained from carrying out substantive procedures that depend on auditor’s assessments of control and inherent risk. The assessed levels of inherent and control risk cannot be sufficiently low to eliminate the need for the auditor to perform any substantive procedures. These substantive procedures may include external confirmation procedures for the assertion of the financial statements.
   11. VSA 400 Risk Assessments and Internal Control requires that the higher the assessment of inherent and control risk, the more audit evidence the auditor should obtain from the performance of substantive procedures. Therefore, when the assessed levels of inherent and control risk increase, the auditor should perform substantive procedures to further collect appropriate audit evidence concerning an assertion of the financial statements. In the circumstances, using external confirmation procedures brings effect on adequately provision of appropriate audit evidence.
   12. The lower the assessment of inherent and control risk, the less assurance the auditor should obtain from the performance of substantive procedures in order to express an opinion on an assertion of the financial statements.
   13. Complex or unusual transactions can result in a higher level of inherent and control risk than that of normal ones. Where the entity being audited has unusual or complex transactions and the assessed level of its inherent and control risk is high, the auditor should check external confirmations kept by the entity concerning contents relevant to these transactions with related parties.

Assertions Addressed by External Confirmations

14. VSA 500 Audit evidence requires that assertions of the financial statements should satisfy the creteria, including: existence, rights and obligations, occurrence, completeness, valuation, accuracy, and disclosure. While external confirmations may provide audit evidence regarding these assertions, the ability of an external confirmation to provide audit evidence relevant to a particular assertion varies.
15. External confirmation of an account receivable provides reliable and relevant audit evidence regarding the existence of the account as at a certain date. Confirmation also provides audit evidence regarding the operation of cut-off procedures. However, such confirmation does not ordinarily provide all the necessary audit evidence relating to the valuation assertion, since it is not practicable to ask the debtor to confirm detailed information relating to its ability to pay the account.
16. Similarly, in the case of goods held on consignment, external confirmation is likely to provide reliable and relevant audit evidence to support the existence and the rights and obligations assertions, but might not provide audit evidence that supports the valuation assertion.
17. The relevance of external confirmations to auditing a particular assertion is also affected by the objective of the auditor in selecting information for confirmation. For example, when auditing the completeness assertion for accounts payable, the auditor and the audit firm need to obtain audit evidence that there is no material unrecorded liability. Accordingly, sending confirmation requests to an entity’s principal suppliers asking them to provide copies of their statements of account directly to the auditor, even if the records show no amount currently owing to them, will usually be more effective in detecting unrecorded liabilities than selecting accounts for confirmation based on the larger amounts recorded in the accounts payable subsidiary ledger.
18. When obtaining audit evidence for assertions not adequately addressed by confirmations, the auditor considers other audit procedures to complement confirmation procedures or to be used instead of confirmation procedures.

Design of the external confirmation request

19. The auditor and the audit firm should tailor external confirmation requests to the specific audit objective. When designing the request, the auditor considers the assertions being addressed and the factors that are likely to affect the reliability of the confirmations. Factors such as the form of the external confirmation request, prior experience on the audit or similar engagements, the nature of the information being confirmed, and the intended respondent, affect the design of the requests because these factors have a direct effect on the reliability of the audit evidence obtained through external confirmation procedures.
20. Also, in designing the request, the auditor and the audit firm consider the type of information respondents will be able to confirm readily since this may affect the response rate and the nature of the audit evidence obtained. For example, certain respondents’ information systems may facilitate the external confirmation of single transactions rather than of entire account balances. In addition, respondents may not always be able to confirm certain types of information, such as the overall accounts receivable balance, but may be able to confirm individual invoice amounts within the total balance.
21. Confirmation requests ordinarily include management’s authorization to the respondent to disclose the information to the auditor. Respondents may be more willing to respond to a confirmation request containing management’s authorization, and in some cases may be unable to respond unless the request contains management’s authorization.

Use of positive and negative confirmations

22. The auditor may use open or closed external confirmation requests or a combination of both.
23. An open (positive) external confirmation request asks the respondent to reply to the auditor in all cases either by indicating the respondent’s agreement with the given information, or by asking the respondent to fill in information. A response to an open confirmation request is ordinarily expected to provide reliable audit evidence. There is a risk, however, that a respondent may reply to the confirmation request without verifying that the information is correct. The auditor is not ordinarily able to detect whether this has occurred. The auditor may reduce this risk, however, by using open confirmation requests that do not state the amount (or other information) on the confirmation request, but ask the respondent to fill in the amount or furnish other information. On the other hand, use of this type of open confirmation request may result in lower response rates because additional effort is required of the respondents.
24. A closed (negative) external confirmation request asks the respondent to reply only in the event of disagreement with the information provided in the request. However, when no response has been received to a closed confirmation request, the auditor remains aware that there will be no explicit audit evidence that intended third parties have received the confirmation requests and verified that the information contained therein is correct. Accordingly, the use of closed (negative) confirmation requests ordinarily provides less reliable audit evidence than the use of open (positive) confirmation requests, and the auditor considers performing other substantive procedures to supplement the use of negative confirmations.
25. Closed (negative) confirmation requests may be used to reduce the risk of material misstatement to an acceptable level when:
    1. The assessed risk of material misstatement is lower;
    2. A large number of small balances is involved;
    3. A substantial number of errors is not expected; and
    4. The auditor has no reason to believe that respondents will disregard these requests.
26. A combination of positive and negative external confirmations may be used. For example, where the total accounts receivable balance comprises a small number of large balances and a large number of small balances, the auditor may decide that it is          appropriate to confirm all or a sample of the large balances with positive confirmation requests and a sample of the small balances using negative confirmation requests.

Management Requests

27. When the auditor seeks to confirm certain balances or other information, and management requests the auditor not to do so, the auditor and the audit firm should consider whether there are valid grounds for such a request and obtain audit evidence to support the validity of management’s requests. If the auditor agrees to management’s request not to seek external confirmation regarding a particular matter, the auditor and the audit firm should apply alternative audit procedures to obtain sufficient appropriate audit evidence regarding that matter.
28. If the auditor and the audit firm do not accept the validity of management’s request     and is prevented from carrying out the confirmations, there has been a limitation on the scope of the auditor’s work and the auditor and the audit firm should consider the possible impact on the auditor’s report.
29. When considering the reasons provided by management, the auditor and the audif firm apply an attitude of professional skepticism and consider whether the request has any implications regarding management’s integrity. The auditor considers whether management’s request may indicate the possible existence of fraud or error. If the auditor believes that fraud or error exists, the auditor applies the guidance in VSA 240 Fraud and Error. The auditor also considers whether the alternative audit procedures will provide sufficient appropriate audit evidence regarding that matter.

Characteristics of Respondents

30. The reliability of audit evidence provided by a confirmation is affected by the respondent’s competence, independence, authority to respond, knowledge of the matter being confirmed, and objectivity. For this reason, the auditor and the audit firm attempt to ensure, where practicable, that the confirmation request is directed to an appropriate individual. For example, when confirming that a covenant related to an entity’s long-term debt has been waived, the auditor directs the request to an official of the creditor who has knowledge about the waiver and has the authority to provide the information.
31. The auditor and the audit firm also assess whether certain parties may not provide an objective or unbiased response to a confirmation request. Information about the respondent’s competence, knowledge, motivation, ability or willingness to respond may come to the auditor’s attention. The auditor considers the effect of such information on designing the confirmation request and evaluating the results, including determining whether additional audit procedures are necessary. The auditor also considers whether there is sufficient basis for concluding that the confirmation request is being sent to a respondent from whom the auditor can expect a response that will provide sufficient appropriate audit evidence. For example, the auditor may encounter significant unusual year-end transactions that have a material effect on the financial statements, the transactions being with a third party that is economically dependent upon the entity. In such circumstances, the auditor and the audit firm consider whether the third party may be motivated to provide an inaccurate response.

The External Confirmation Process

32. When performing confirmation procedures, the auditor and the audit firm should maintain control over the process of selecting those to whom a request will be sent, the preparation and sending of confirmation requests, and the responses to those requests. Control is maintained over communications between the intended recipients and the auditor to minimize the possibility that the results of the confirmation process will be biased because of the interception and alteration of confirmation requests or responses. The auditor ensures that it is the auditor who sends out the confirmation requests, that the requests are properly addressed, and that it is requested that all replies are sent directly to the auditor. The auditor considers whether replies have come from the purported senders.

No Response to a Positive Confirmation Request

33. The auditor and the audit firm should perform alternative audit procedures where no response is received to a positive external confirmation request. The alternative audit procedures should be such as to provide audit evidence about the assertions that the confirmation request was intended to provide.
34. Where no response is received, the auditor and the audit firm ordinarily contact the recipient of the request to elicit a response. Where the auditor and the audit firm are unable to obtain a response, the auditor uses alternative audit procedures. The nature of alternative audit procedures varies according to the account and assertion in question. In the examination of accounts receivable, alternative audit procedures may include examination of subsequent cash receipts, examination of shipping documentation or other client documentation to provide audit evidence for the existence assertion, and examination of sales near the period-end to provide audit evidence for the cutoff assertion. In the examination of accounts payable, alternative audit procedures may include examination of subsequent cash disbursements or correspondence from third parties to provide audit evidence of the existence assertion, and examination of other records, such as goods received notes, to provide audit evidence of the completeness assertion.

Reliability of Responses Received

35. The auditor and the audit firm consider whether there is any indication that external confirmations received may not be reliable. The auditor considers the response’s authenticity and performs audit procedures to dispel any concern. The auditor may choose to verify the source and contents of a response in a telephone call to the purported sender. In addition, the auditor requests the purported sender to mail the original confirmation directly to the auditor. With ever-increasing use of technology, the auditor considers validating the source of replies received in electronic format (for example, fax or electronic mail). Oral confirmations are documented in the work papers. If the information in the oral confirmations is significant, the auditor requests the parties involved to submit written confirmation of the specific information directly to the auditor.

Causes and Frequency of Exceptions

36. When the auditor and the audit firm form a conclusion that the confirmation process and alternative audit procedures have not provided sufficient appropriate audit evidence regarding an assertion, the auditor should perform additional audit procedures to obtain sufficient appropriate audit evidence.

In forming the conclusion, the auditor considers the:

1. Reliability of the confirmations and alternative audit procedures;
2. Nature of any exceptions, including the implications, both quantitative and qualitative of those exceptions; and
3. Audit evidence provided by other audit procedures.

Based on this evaluation, the auditor determines whether additional audit procedures are needed to obtain sufficient appropriate audit evidence.

37. The auditor also considers the causes and frequency of exceptions reported by respondents. An exception may indicate a misstatement in the entity’s records, in which case, the auditor determines the reasons for the misstatement and assesses whether it has a material effect on the financial statements. If an exception indicates a misstatement, the auditor reconsiders the nature, timing and extent of audit procedures necessary to provide the audit evidence required.

Evaluating the Results of the Confirmation Process

38. The auditor should evaluate whether the results of the external confirmation process together with the results from any other audit procedures performed, provide sufficient appropriate audit evidence regarding the assertion being audited. In conducting this evaluation the auditor and the audit firm consider the guidance provided by VSA 530 Audit Sampling and Other Means of Testing.

External Confirmations Prior to the Year-End

39. When the auditor uses confirmation as at a date prior to the year-end to obtain audit evidence to support an assertion, the auditor obtains sufficient appropriate audit evidence that transactions relevant to the assertion in the intervening period have not been materially misstated. In fact, when inherent and control risks are low and medium, the auditor may decide to confirm balances at a date other than the period end, for example, when the audit is to be completed within a short time after the balance sheet date. As with all types of pre-year-end work, the auditor considers the need to obtain further audit evidence relating to the remainder of the period./.

***