Since the issuance of SAS No. 31 and its successor, SAS No. 106 entitled Audit Evidence, auditors understand the primary purpose of the confirmation process is to verify the existence assertion. Whether we send positive confirmations, negative confirmations or review subsequent collections and related sales invoices or shipping documents, the auditor’s control of the confirmation process makes the primary contribution to verifying the existence assertion.
Think about it. Negative confirmations are returned only when the customer notices an error and, studies have shown, errors are noticed only 2% of the time! We think positive confirmations are more reliable but similar studies have produced similar results! Furthermore, we rarely know the persons signing the positive confirmations--it could have been the night janitor! We often review subsequent collections but don't examine related sales invoices and shipping documents to verify the existence, occurrence and cutoff assertions. So what's left? The confirmation process is our best tool for verifying the existence of a customer. This may be a shocker, but chances are your confirmation process is also faulty!
Here's part of the process from one of my earlier blogs:
1. Obtain an aged trial balance of accounts and reconcile it to the general ledger.
2. Decide on a selection method (random-number, systematic or haphazard), calculate the desired sample size based on risk and materiality at the assertion level.
3. Select accounts for confirmation preparation and decide on positive or negative requests.
4. Prepare confirmations (or supervise client preparation).
5. When client prepares confirmations, make sure all those requested are completed and that names, addresses and amounts agree to client records.
6. Independently verify a sample of customer addresses (phone book, Google, city directories, etc.).
Whoa! Let's stop here. Verification of customer addresses is the foundation of the confirmation process. The reliability of evidence obtained from confirmations depends on the validity of customer's addresses. Here it is simply. If the validity of customer addresses isn't tested properly, the confirmation process is invalid!
I once performed a director's examination of a small bank and sent confirmations to all individually significant notes receivable customers. All confirmations were returned in a short time period with almost no discrepancies! When the bank collapsed about six months later, a hand-writing analyst discovered at least 70% of the confirmations were signed by the bank's vice-president! How did this happen? We obtained customer's addresses from the bank's loan files, most of which files had been fabricated! We sent the confirmations to fictitious addresses!
So, what's the solution? Test customer addresses! When performing and relying on tests of controls, include customer address verification as one of the procedures for the sales and collection cycle. When performing a systems walk-through procedure and selecting 5, 10 or 15 transactions depending on risk, verify the customers' addresses. If customers" addresses aren't verified prior to sending confirmations as tests of balances, verify addresses for some of the confirmation selections according to the assessed level of risk of material misstatement (usually at least 20-25%).
Address verification can be performed in numerous ways to provide some evidence about a customer's existence. Google searches or, if necessary, requesting addresses from numerous online data collection organizations are usually the most efficient procedures. Phone books, city directories or other published advertising materials may also provide independent evidence of customers' existence. Whatever the source of the evidence, the sample of customers selected for address verification must be made in some representative way. As with any sample selection method, documentation of the procedure must indicate how bias was avoided in the selection process.
As peer reviewers increase their focus on the reliability of audit evidence, what will they find in your audit files? A reliable confirmation process or an audit error? Worse yet, what would a plaintiff's attorney find if an adversarial action is filed against your firm? If you want more information on How to Audit Accounts Receivable (or other financial statement classifications), you can order my small PDF book, practice aids and PowerPoint slides for $29 by sending an email to email@example.com . You can also order a resource bundle of 12 recorded webcasts on how to audit all major audit areas (including text materials and practice aids) for $199 using this link: http://www.cpelink.com/product/detail.php?p=2138 .