If auditor determines respondent is incompetent, the confirmation should not be used as audit evidence. OR if response is sent back in a way different from how the auditor sent the request, work must be done to ensure validity of the response or request original confirmation to be sent back from the respondent. With the use of technology, auditor will want to confirm “the electronic confirmation process is secure and properly controlled, the information is obtained directly by the auditor, and the information is obtained from a third party who is the intended recipient.” (AU330)
a. In AU-C-330: “factors that may assist the auditor in determining whether external confirmation procedures are to be performed as substantive audit procedures include the following:” Confirming party’s knowledge of the subject matter, the respondent is reliable if they have knowledge about the information being confirmed; the ability/willingness of the intended confirming party to respond (brushing it off/not accept responsibility, too time consuming to respond, legal issues from responding, different currencies, responding not in job duties); The objectivity of the intended party (not reliable if the intended party is part of the entity.
b. May also be ineffective when, based on prior years’ audit experience, response rates inadequate or known to be unreliable – should probably obtain audit evidence from other sources at that point
c. AU-C-505: “Audit evidence is more reliable when it is obtained from independent sources outside the entity; Audit evidence obtained directly by the auditor is more reliable than audit evidence obtained indirectly or by inference; Audit evidence is more reliable when it exists in documentary form, whether paper, electronic, or other medium.” Reliability:
i. “if auditor identifies factors that give rise to doubts about the reliability of the response… should obtain further evidence to resolve those doubts (example: was received indirectly, or appeared not to come from the originally intended confirming party)… ii. if determines that response to request is not reliable, should evaluate implications on the assessment of the relevant risks of material misstatement, including risk of fraud and on the related nature, timing, and extent of other audit procedures (information obtained may not be from authentic source, respondent may not be knowledgeable about the information confirmed, the integrity of the information may have been compromised).”
d. AU505: “When evaluating the results of individual external confirmation requests, the auditor may categorize such results as follows:
i. A response by the appropriate confirming party indicating agreement with the information provided in the confirmation request or providing requested information without exception ii. A response deemed unreliable iii. A nonresponse iv. A response indicating an exception” (ex: not material, timing difference, clerical error, measurement, etc)
These will help determine whether further audit evidence is required