2023-22491. Public Company Accounting Oversight Board; Notice of Filing of Proposed Rules on the Auditor's Use of Confirmation, and Other Amendments to Related PCAOB Standards

October 5, 2023.

Pursuant to Section 107(b) of the Sarbanes-Oxley Act of 2002 (the “Act”), notice is hereby given that on October 4, 2023, the Public Company Accounting Oversight Board (the “Board” or “PCAOB”) filed with the Securities and Exchange Commission (the “Commission” or “SEC”) the proposed rules described in Items I and II below, which items have been prepared by the Board. The Commission is publishing this notice to solicit comments on the proposed rules from interested persons.

I. Board's Statement of the Terms of Substance of the Proposed Rules

On September 28, 2023, the Board adopted amendments to auditing standards for the auditor's use of confirmation, and amendments to related PCAOB standards (collectively, the “proposed rules”), including the retitling and replacement of an existing standard with a new standard. The text of the proposed rules appears in Exhibit A to the SEC Filing Form 19b–4 and is available on the Board's website at https://pcaobus.org/​about/​rules-rulemaking/​rulemaking-dockets/​docket-028-proposed-auditing-standard-related-to-confirmation and at the Commission's Public Reference Room.

II. Board's Statement of the Purpose of, and Statutory Basis for, the Proposed Rules

In its filing with the Commission, the Board included statements concerning the purpose of, and basis for, the proposed rules and discussed comments it received on the proposed rules. The text of these statements may be examined at the places specified in Item IV below. The Board has prepared summaries, set forth in sections A, B, and C below, of the most significant aspects of such statements. In addition, the Board is requesting that the Commission approve the proposed rules, pursuant to Section 103(a)(3)(C) of the Act, for application to audits of emerging growth companies (“EGCs”), as that term is defined in Section 3(a)(80) of the Securities Exchange Act of 1934 (“Exchange Act”). The Board's request is set forth in section D.

A. Board's Statement of the Purpose of, and Statutory Basis for, the Proposed Rules

(a) Purpose

Summary

The Board is replacing AS 2310, The Confirmation Process, in its entirety with a new standard, AS 2310, The Auditor's Use of Confirmation (“new standard”) to strengthen and modernize the requirements for the confirmation process. As described in the new standard, the confirmation process involves selecting one or more items to be confirmed, sending a confirmation request directly to a confirming party ( e.g., a financial institution), evaluating the information received, and addressing nonresponses and incomplete responses to obtain audit evidence about one or more financial statement assertions. If properly designed and executed by an auditor, the confirmation process may provide important evidence that the auditor obtains as part of an audit of a company's financial statements.

Why the Board Is Adopting These Changes Now

AS 2310 is an important standard for audit quality and investor protection, as the audit confirmation process touches nearly every audit. The standard was initially written over 30 years ago and has had minimal amendments since its adoption by the PCAOB in 2003.

The Board adopted the new standard after substantial outreach, including several rounds of public comment. The PCAOB previously considered updating AS 2310 by issuing a concept release in 2009 and a proposal in 2010 for a new auditing standard that would supersede AS 2310. While the PCAOB did not amend or replace AS 2310 at that time, subsequent developments—including the increasing use of electronic communications and third-party intermediaries in the confirmation process—led the Board to conclude that enhancements to AS 2310 and modifications to the approach proposed in 2010 could improve the quality of audit evidence obtained by auditors. In addition, the Board has observed continued inspection findings related to auditors' use of confirmation, as well as enforcement actions involving failures to adhere to requirements in the existing auditing standard regarding confirmation, such as the requirement for the auditor to maintain control over the confirmation process.

Accordingly, having considered these developments and input from commenters, the Board revisited the previously proposed changes and issued a new proposed standard to replace AS 2310, along with conforming amendments to other PCAOB auditing standards, in December 2022. Commenters generally supported the Board's objective of improving the confirmation process, and suggested areas to further improve the new standard, modify proposed requirements that would not likely improve audit quality, and clarify the application of the new standard. In adopting the new standard and related amendments, the Board has taken into account all of these comments, as well as observations from PCAOB oversight activities.

Key Provisions of the New Standard

The new standard and related amendments are intended to enhance the PCAOB's requirements on the use of confirmation by describing principles-based requirements that apply to all methods of confirmation, including paper-based and electronic means of communications. In addition, the new standard is more expressly integrated with the PCAOB's risk assessment standards by incorporating certain risk-based considerations and emphasizing the auditor's responsibilities for obtaining relevant and reliable audit evidence through the confirmation process. Among other things, the new standard:

• Includes a new requirement regarding confirming cash and cash equivalents held by third parties (“cash”), or otherwise obtaining relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source;
• Carries forward the existing requirement regarding confirming accounts receivable, while addressing situations where it would not be feasible for the auditor to perform confirmation procedures or obtain relevant and reliable audit evidence for accounts receivable by directly accessing information maintained by a knowledgeable external source;
• States that the use of negative confirmation requests alone does not provide sufficient appropriate audit evidence (and includes examples of situations where the auditor may use negative confirmation requests to supplement other substantive audit procedures);

• Emphasizes the auditor's responsibility to maintain control over the confirmation process and provides that the auditor is responsible for selecting the items to be confirmed, sending confirmation requests, and receiving confirmation responses; and

• Identifies situations in which alternative procedures should be performed by the auditor (and includes examples of such alternative procedures that may provide relevant and reliable audit evidence for a selected item).

(b) Statutory Basis

The statutory basis for the proposed rules is Title I of the Act.

B. Board's Statement on Burden on Competition

Not applicable. The Board's consideration of the economic impacts of the proposed rules is discussed in section D below.

C. Board's Statement on Comments on the Proposed Rules Received From Members, Participants or Others

The Board released the proposed rules for public comment in PCAOB Release No. 2022–009 (Dec. 20, 2022) (“2022 Proposal”). The Board previously issued a concept release for public comment in PCAOB Release No. 2009–002 (Apr. 14, 2009) (“2009 Concept Release”) and a proposed auditing standard related to confirmation and related amendments to PCAOB standards in PCAOB Release No. 2010–003 (July 13, 2010) (“2010 Proposal”). The Board received 98 written comment letters relating to the 2022 Proposal, the 2009 Concept Release, and the 2010 Proposal. The Board has carefully considered all comments received. The Board's response to the comments it received and the changes made to the rules in response to the comments received are discussed below.

Background

Information obtained by the auditor directly from knowledgeable external sources, including through confirmation, can be an important source of evidence obtained as part of an audit of a company's financial statements.^[1] Confirmation has long been used by auditors. For example, one early auditing treatise noted the importance of confirmation for cash deposits, accounts receivable, and demand notes.^[2] In addition, confirmation of accounts receivable has been a required audit procedure in the United States since 1939, when the American Institute of Accountants ^[3] adopted Statement on Auditing Procedure No. 1 (“SAP No. 1”) as a direct response to the McKesson & Robbins fraud case, which involved fraudulently reported inventories and accounts receivable that the independent auditors failed to detect after performing other procedures that did not involve confirmation.^[4]

SAP No. 1 required confirmation of accounts receivable by direct communication with customers in all independent audits of financial statements, subject to the auditor's ability to overcome the presumption to confirm accounts receivable for certain reasons. Following the adoption of SAP No. 1, the accounting profession also adopted a requirement in 1942, which remained in effect until the early 1970s, that auditors should disclose in the auditor's report when confirmation of accounts receivable was not performed. The AICPA's subsequent revisions to its auditing standards included the promulgation of AU sec. 330, The Confirmation Process, which was adopted in 1991 and took effect in 1992. The PCAOB adopted AU sec. 330 (now AS 2310) as an interim standard in 2003.^[5]

The amendments to the standards for the auditor's use of confirmation are intended to improve audit quality through principles-based requirements that apply to all methods of confirmation and are more expressly integrated with the Board's risk assessment standards. These enhancements should also lead to improvements in practice, commensurate with the associated risk, among audit firms of all sizes. The expected increase in audit quality should also enhance the credibility of information provided in a company's financial statements.

Rulemaking History

The final amendments to the auditing standards reflect public comments on a concept release and two proposals. In April 2009, the PCAOB issued a concept release seeking public comment on the potential direction of a standard-setting project that could result in amendments to the PCAOB's existing standard on the confirmation process or a new auditing standard that would supersede the existing standard.^[6] The 2009 Concept Release discussed existing requirements and posed questions about potential amendments to those requirements.

In July 2010, the PCAOB proposed an auditing standard that, if adopted, would have superseded the existing confirmation standard.^[7] The 2010 Proposal was informed by comments on the 2009 Concept Release and was intended to strengthen the existing standard by, among other things, expanding certain requirements and introducing new requirements. In general, commenters on the 2010 Proposal supported updating the existing standard to address relevant developments in audit practice, including greater use of emailed confirmation requests and responses and the involvement of third-party intermediaries. At the same time, some commenters asserted that the proposed requirements in the 2010 Proposal were unduly prescriptive ( i.e., included too many presumptively mandatory requirements) and would result in a significant increase in the volume of confirmation requests without a corresponding increase in the quality of audit evidence obtained by the auditor. The PCAOB did not adopt the 2010 Proposal.

In December 2022, the Board issued a proposed auditing standard to improve the quality of audits when confirmation is used by the auditor and to reflect changes in the means of communication and in business practice since the standard was originally issued.^[8] The 2022 Proposal was informed by comments on the 2009 Concept Release and 2010 Proposal and specified the auditor's responsibilities regarding the confirmation process. The Board received 46 comment letters on the 2022 Proposal from commenters across a range of affiliations. Those comments are discussed throughout this release. Commenters on the 2022 Proposal generally expressed support for the project's objective and suggested ways to revise or clarify the proposed standard. The Board considered the comments on the 2022 Proposal, as well as on the 2009 Concept Release and the 2010 Proposal, in developing the final amendments.^[9] The Board also considered observations from PCAOB oversight activities.

Existing Standard

This section discusses key provisions of the existing PCAOB auditing standard on the confirmation process.

In 2003, the PCAOB adopted the standard now known as AS 2310 (at that time, AU sec. 330), when it adopted the AICPA's standards then in existence. Existing AS 2310 indicates that confirmation is the process of obtaining and evaluating a direct communication from a third party in response to a request for information about a particular item affecting financial statement assertions.^[10] For example, an auditor might request a company's customers to confirm balances owed at a certain date, or request confirmation of a company's accounts or loans payable to a bank at a certain date.

Key provisions of existing AS 2310 include the following:

• A presumption that the auditor will request confirmation of accounts receivable. The standard states that confirmation of accounts receivable is a generally accepted auditing procedure and provides the situations in which the auditor may overcome the presumption.
• Procedures for designing the confirmation request, including the requirement that the auditor direct the confirmation request to a third party who the auditor believes is knowledgeable about the information to be confirmed.

• Procedures relating to the use of both positive and negative confirmation requests. A positive confirmation request directs the recipient to send a response back to the auditor stating the recipient's agreement or disagreement with information stated in the request, or furnishing requested information. A negative confirmation request directs the recipient to respond back to the auditor only when the recipient disagrees with information in the auditor's request. The standard states that “[n]egative confirmation requests may be used to reduce audit risk to an acceptable level when (a) the combined assessed level of inherent and control risk is low, (b) a large number of small balances is involved, and (c) the auditor has no reason to believe that the recipients of the requests are unlikely to give them consideration.” ^[11] If negative confirmation requests are used, the auditor should consider performing other substantive procedures to supplement their use.^[12]

• A requirement for the auditor to maintain control over confirmation requests and responses by establishing direct communication between the intended recipient and the auditor.
• Procedures to consider when the auditor does not receive a written confirmation response via return mail, including how the auditor should evaluate the reliability of oral and facsimile responses to written confirmation requests. The standard provides that, when confirmation responses are in other than a written format mailed to the auditor, additional evidence may be necessary to establish the validity of the respondent.
• A requirement that the auditor should perform alternative procedures when the auditor has not received a response to a positive confirmation request.
• Requirements for the auditor's evaluation of the results of confirmation procedures and any alternative procedures performed by the auditor. These provisions include the requirement that, if the combined evidence provided by confirmation, alternative procedures, and other procedures is not sufficient, the auditor should request additional confirmations or extend other tests, such as tests of details or analytical procedures.

Current Practice

This section discusses the Board's understanding of current practice based on, among other things, observations from oversight activities of the Board and SEC enforcement actions.

Overview of Current Practice

The audit confirmation process touches nearly every financial statement audit conducted under PCAOB auditing standards. This is due in part to the presumption in existing AS 2310 that the auditor will confirm accounts receivable, which include claims against customers that have arisen from the sale of goods or services in the normal course of business and a financial institution's loans, unless certain exemptions apply. In addition, audit methodologies of many larger audit firms affiliated with global networks recommend or require confirming cash accounts. In the past, the use of confirmation was a common practice for auditing a financial institution's customer deposits. In recent years, however, there has been an increased wariness about phishing attempts by unauthorized parties aimed at obtaining sensitive personal or financial information of customers. As a result, some customers might not understand or trust an -unsolicited confirmation request from an auditor and, indeed, many financial institutions and other companies now advise customers not to reply to unsolicited correspondence concerning their accounts or other customer relationships.^[13]

Existing AS 2310 was written at a time when paper-based confirmation requests and responses were the prevailing means of communication. Since then, emailed confirmation requests and responses, and the use of technology-enabled confirmation tools, including the use of intermediaries to facilitate the confirmation process, have become commonplace. For example, numerous financial institutions in the United States, and an increasing number of international banks, mandate the use of an intermediary as part of the confirmation process and will not otherwise respond to an auditor's confirmation request.

As noted above, existing AS 2310 provides that the auditor should maintain control over the confirmation process. In practice, complying with this requirement involves the auditor directly sending the confirmation request to the confirming party via mail or email, without involving company personnel. The auditor's confirmation request generally specifies that any correspondence should be sent directly to the auditor's location (or email address) to minimize the risk of interference by company personnel. When an intermediary facilitates direct electronic communications between the auditor and the confirming party, the auditor is still required to maintain control over the confirmation process. Procedures performed by audit firms to address this requirement vary depending on facts and circumstances. Some auditors have used a report on controls at a service organization (“SOC report”) to evaluate the design and operating effectiveness of the intermediary's controls relevant to sending and receiving confirmations.

Under the existing standard, auditors can use positive confirmation requests and, provided certain conditions are met, negative confirmation requests. A positive confirmation request either asks the recipient to respond directly to the auditor about whether the recipient agrees with information that is stated in the request or asks the recipient to provide the requested information by filling in a blank form. In comparison, a negative confirmation request directs the recipient to respond only when the recipient disagrees with the information included in the request. In practice, negative confirmation requests have typically been used to obtain audit evidence related to the completeness of deposit liabilities and other accounts of a similar nature and, less frequently, to obtain evidence related to the existence of accounts receivable. In some cases, auditors use a combination of positive and negative confirmation requests.

Observations From Inspections and Enforcement Actions

This section discusses observations from PCAOB oversight activities and SEC enforcement actions, including (1) PCAOB inspections of registered public accounting firms (“firms”) and (2) enforcement actions relating to deficient confirmation procedures performed by the auditor. These observations have informed the Board's view that providing greater clarity as the Board strengthens the requirements could result in improved compliance by auditors.

Inspections. Over the past several years, PCAOB inspections indicated that some auditors did not fulfill their responsibilities under the existing standard when performing confirmation procedures. The shortcomings have been noted at large and small domestic firms, and at large firms with domestic and international practices. For example, some auditors did not: (1) consider performing procedures to verify the source of confirmation responses received electronically; (2) perform sufficient alternative procedures; (3) restrict the use of negative confirmation requests to situations where the risk of material misstatement was assessed as low; or (4) maintain appropriate control over the confirmation process, including instances where company personnel were involved in either sending or receiving confirmations.

The PCAOB has also continued to monitor developments relating to the use of confirmation through its other oversight and research activities. For example, in 2021, the PCAOB staff issued a Spotlight discussing, among other things, the use of technology in the confirmation process.^[14] In addition, in 2022, the PCAOB staff issued a Spotlight that specifically discussed observations and reminders on the use of a service provider in the confirmation process.^[15]

Enforcement actions. Over the years, there have been a number of enforcement actions by the PCAOB and the SEC alleging that auditors failed to comply with PCAOB standards related to the confirmation process. Enforcement actions have been brought against large and small firms, and against U.S. and non-U.S. firms.

For example, PCAOB enforcement cases have involved allegations that auditors failed to: (1) perform appropriate confirmation procedures to address a fraud risk; ^[16] (2) adequately respond to contradictory audit evidence obtained from confirmation procedures; ^[17] (3) perform appropriate confirmation procedures and alternative procedures for accounts receivable; ^[18] or (4) maintain proper control over the confirmation process.^[19]

In several confirmation-related enforcement cases, the SEC alleged that the deficient confirmation procedures by the auditors involved companies that had engaged in widespread fraud, where properly performed confirmation procedures might have led to the detection of the fraudulent activity.^[20] Further, in a number of proceedings, the SEC alleged that confirmation procedures were not properly designed ^[21] or, more frequently, that the auditors failed to adequately evaluate responses to confirmation requests and perform alternative or additional procedures in light of exceptions, nonresponses, or responses that should have raised issues as to their reliability or the existence of undisclosed related parties.^[22] Several of these proceedings were brought in recent years, suggesting that problems persist in this area.

Reasons To Improve Auditing Standards

The amendments to PCAOB standards being adopted are intended to enhance audit quality by clarifying and strengthening the requirements for the auditor's use of confirmation. The final amendments are also more expressly integrated with the PCAOB's risk assessment standards by incorporating certain risk-based considerations and emphasizing the auditor's responsibilities for obtaining relevant and reliable audit evidence through the confirmation process. The Board believes that these improvements will enhance both audit quality and the credibility of the information provided in a company's financial statements.

Areas of Improvement

The Board has identified two important areas where improvements are warranted to existing standards, discussed below: (1) updating the standards to reflect developments in practice and (2) clarifying the auditor's responsibilities to evaluate the reliability of evidence obtained through confirmation responses.

Updating the Standards To Reflect Developments in Practice

The new standard supports the auditor's use of electronic forms of communication between the auditor and the confirming party. Since the AICPA standard on the confirmation process adopted by the PCAOB took effect in 1992, there has been a significant change in the auditing environment and the means by which an auditor communicates with confirming parties. Emails and other forms of electronic communications between auditors and confirming parties have become ubiquitous, and third-party intermediaries now often facilitate the electronic transmission of confirmation requests and responses between auditors and confirming parties.

In addition, the Board believes its auditing standards should allow for continued innovation by auditors in the ways they obtain audit evidence. Traditionally, auditors have used confirmation in circumstances where reliable evidence about financial statement assertions could be obtained directly from a third party that transacts with the company ( e.g., to confirm the existence of cash or accounts receivable). Generally, audit evidence obtained directly from knowledgeable external sources, including through confirmation, has been viewed as more reliable than evidence obtained through other audit procedures available to the auditor,^[23] especially where the auditor identified a risk of fraud, chose not to test controls, or determined that controls could not be relied on.^[24]

The PCAOB staff's research indicates that some audit firms may have developed or may yet develop audit techniques that enable the auditor to obtain relevant and reliable audit evidence for the same assertions by performing substantive audit procedures that do not include confirmation, as discussed in more detail below. To reflect these developments, the new standard allows the performance of other procedures in lieu of confirmation for cash and accounts receivable in situations where the auditor can obtain relevant and reliable audit evidence by directly accessing information maintained by knowledgeable external sources. Further, the new standard acknowledges that, in certain situations, it may not be feasible for the auditor to obtain audit evidence for accounts receivable directly from a knowledgeable external source and provides that in those situations the auditor should obtain external information indirectly by performing other substantive procedures, including tests of details.

Clarifying the Auditor's Responsibilities To Evaluate the Reliability of Confirmation Responses

While information obtained through the confirmation process can be an important source of audit evidence, the confirmation process must be properly executed for the evidence obtained to be relevant and reliable. The enforcement actions discussed above and other recent high-profile financial reporting frauds have also called attention to the importance of well-executed confirmation procedures, including the confirmation of cash.^[25] In addition, PCAOB oversight activities have identified instances in which auditors did not obtain sufficient appropriate audit evidence when using confirmation. Accordingly, the new standard includes a new requirement to confirm certain cash balances and clarifies the auditor's responsibilities to evaluate the reliability of evidence obtained through confirmation responses (and, when necessary, to obtain audit evidence through alternative procedures).

Comments on the Reasons for Standard Setting

Many commenters on the 2022 Proposal broadly expressed support for revisions to the Board's standard on the auditor's use of confirmation to reflect developments in practice since the AICPA standard on the confirmation process adopted by the PCAOB took effect in 1992. A number of commenters also agreed that the standard on the auditor's use of confirmation should be more closely aligned with the Board's risk assessment standards. In addition, some commenters stated that updates to the PCAOB's standard on the auditor's use of confirmation would be generally consistent with their prior recommendations to the Board that the Board modernize its interim auditing standards. Other commenters suggested that the Board should also engage in additional outreach with investors or that it consider other mechanisms to engage with stakeholders prior to the adoption of standards, such as roundtables and pre-implementation “field testing” of proposed standards.

In addition, several commenters expressed support for the proposition that the PCAOB's auditing standards should allow for continued innovation by auditors in the ways they obtain audit evidence. These commenters generally stated that standards should be written to evolve with future technologies, including new methods of confirmation that may arise from technological changes in auditing in the future. A few commenters stated that the 2022 Proposal provided flexibility to respond to the current use of technology in the audit process, or left enough room for judgment-based application for further advances in technology. In comparison, some commenters stated that the proposed standard was not sufficiently forward-looking. Several commenters cautioned against more explicitly addressing the use of technology ( i.e., by adding prescriptive requirements), noting that doing so might not allow the standard to age effectively with time and innovation.

Several commenters broadly expressed support for the Board's goal, as described in the 2022 Proposal, of improving the quality of audit evidence obtained by auditors when using confirmation. One of these commenters stated that it was critical that confirmation requests are properly designed and that confirmation responses are appropriately evaluated, especially when there are confirmation exceptions or concerns about their reliability. In addition, other commenters generally expressed support for the proposed requirements and stated they would lead to improvements in audit quality. A number of commenters, primarily firms and firm-related groups, asserted that certain requirements in the 2022 Proposal were unduly prescriptive and that the final standard should be more principles-based and risk-based to allow for more auditor judgment. In comparison, an investor-related group suggested that the Board remind auditors that, in exercising professional judgment, their judgments must be reasonable, careful, documented, and otherwise in compliance with applicable professional requirements.

In adopting the new standard, the Board has considered these comments on the 2022 Proposal, as well as the comments received on the 2010 Proposal and the 2009 Concept Release. Based on the information available to the Board—including the current regulatory baseline, observations from our oversight activities, academic literature, and comments—the Board believes that investors will benefit from strengthened and clarified auditing standards in this area. To the extent that commenters provided comments or expressed concerns about specific aspects of the proposed revisions to the Board's existing standard on the auditor's use of confirmation, the Board's consideration of these comments is discussed further below and elsewhere in this exhibit. While the Board does not expect that the new standard will eliminate inspection deficiencies observed in practice, it is intended to clarify the auditor's responsibilities and align the requirements for the use of confirmation more closely with the PCAOB's risk assessment standards.

The new standard also reflects several changes that were made after the Board's consideration of comments received about the potential impact of the proposed new standard on auditors, issuers, and intermediaries. In addition, some commenters called for a broader alignment of PCAOB standards with standards issued by other standard setters, namely the International Auditing and Assurance Standards Board (“IAASB”) and the AICPA's Auditing Standards Board (“ASB”). A few commenters stated that PCAOB standards should be harmonized with IAASB standards, in the interest of global comparability, and, in the view of one commenter, with ASB standards. A few commenters stated that the Board should provide robust and detailed explanations of differences between PCAOB standards and the standards of other standard setters. One commenter indicated that the dual standard-setting structure in the United States ( i.e., the existence of both PCAOB and ASB standards) creates issues that could erode audit quality.

The Board carefully considered the approaches of other standard setters when developing the 2022 Proposal, and the new standard reflects the approach that the Board believes best protects investors and furthers the public interest. As a result, certain differences will continue to exist between the Board's new standard and those of other standard setters, including a number of provisions that the Board believes are appropriate and consistent with its statutory mandate to protect the interests of investors and further the public interest.

Discussion of Final Rules

Overview of New Standard

The new standard replaces existing AS 2310 in its entirety. The provisions of the new standard the Board has adopted are intended to strengthen existing requirements for the auditor's use of confirmation. Key aspects of the new standard:

• Include principles-based requirements that are designed to apply to all methods of confirmation. The new standard is designed to enhance requirements that apply to longstanding methods, such as the use of paper-based confirmation requests and responses sent via regular mail; methods that involve electronic means of communications, such as the use of email or an intermediary to facilitate direct electronic transmission of confirmation requests and responses; and methods that are yet to emerge, thus encouraging audit innovation.

• Expressly integrate the requirements for the auditor's use of confirmation with the requirements of the Board's risk assessment standards, including AS 1105. The new standard specifies certain risk-based considerations and emphasizes the auditor's responsibilities for obtaining relevant and reliable audit evidence when performing confirmation procedures.

• Emphasize the use of confirmation procedures in certain situations. The new standard adds a new requirement that the auditor should perform confirmation procedures for cash held by third parties, carries forward an existing requirement that the auditor should perform confirmation procedures for accounts receivable, and adds a new provision that the auditor may otherwise obtain audit evidence by directly accessing information maintained by a knowledgeable external source for cash and accounts receivable. In addition, the new standard carries forward an existing requirement to consider confirming the terms of certain other transactions.

• Address situations in which it would not be feasible for the auditor to obtain information directly from a knowledgeable external source. The new standard provides that if it would not be feasible for the auditor to obtain audit evidence directly from a knowledgeable external source for accounts receivable, the auditor should perform other substantive audit procedures, including tests of details, that involve obtaining audit evidence from external sources indirectly.

• Communicate to the audit committee certain audit responses to significant risks. Under the new standard, for significant risks associated with cash or accounts receivable, the auditor is required to communicate with the audit committee when the auditor did not perform confirmation procedures or otherwise obtain audit evidence by directly accessing information maintained by a knowledgeable external source.

• Reflect the relatively insignificant amount of audit evidence obtained when using negative confirmation requests. Under the new standard, the use of negative confirmation requests may provide sufficient appropriate audit evidence only when combined with other substantive audit procedures. The new standard includes examples of situations in which the use of negative confirmation requests in combination with other substantive audit procedures may provide sufficient appropriate audit evidence.

• Emphasize the auditor's responsibility to maintain control over the confirmation process. The new standard states that the auditor should select the items to be confirmed, send confirmation requests, and receive confirmation responses.

• Provide more specific direction for circumstances where the auditor is unable to obtain relevant and reliable audit evidence through confirmation. The new standard identifies situations where other procedures should be performed by the auditor as an alternative to confirmation. The new standard also includes examples of alternative procedures that individually or in combination may provide relevant and reliable audit evidence.

Introduction and Objective

(See paragraphs .01 and .02 of the new standard).

The 2022 Proposal included requirements for the auditor's use of confirmation. As discussed in the proposal, the confirmation process involves selecting one or more items to be confirmed, sending a confirmation request directly to a confirming party, evaluating the information received, and addressing nonresponses and incomplete responses to obtain audit evidence about one or more financial statement assertions. Confirmation is one of the specific audit procedures described in PCAOB standards that an auditor could perform when addressing a risk of material misstatement.^[26] As is the case with other audit procedures, information obtained through confirmation may support and corroborate management's assertions or it may contradict such assertions.^[27]

Under the 2022 Proposal, the auditor's objective in designing and executing the confirmation process was to obtain relevant and reliable audit evidence about one or more relevant financial statement assertions of a significant account or disclosure.^[28] Existing AS 2310 does not include an objective.

As discussed below, the Board has modified the introduction and objective in the proposed standard in several respects.

A number of commenters stated that the objective of the proposed standard was clear. One commenter stated that the objective should be to provide requirements and guidance in situations where the auditor, as a result of its risk-assessment procedures, determines that confirmation procedures provide an appropriate response to one or more assertions related to an identified risk of material misstatement. Another commenter asserted that the objective in the proposed standard did not result in greater clarity than the proposed objective in the 2010 Proposal and created a wider gap between the PCAOB's standards and the equivalent standard of the IAASB.

Having considered these comments, the Board has revised the introduction to provide that the new standard establishes requirements regarding obtaining audit evidence from a knowledgeable external source through the auditor's use of confirmation. The introduction further states that the new standard includes additional requirements regarding obtaining audit evidence for cash, accounts receivable, and terms of certain transactions. The Board believes that this language more clearly aligns with the approach to the auditor's use of confirmation in the new standard and the inclusion of specific requirements in the new standard with respect to cash, accounts receivable, and terms of certain transactions.

In addition, the Board has added the phrase “from a knowledgeable external source” to the objective, such that the new standard provides that the objective of the auditor in designing and executing the confirmation process is to obtain relevant and reliable audit evidence from a knowledgeable external source about one or more relevant financial statement assertions of a significant account or disclosure. This language underscores that, when properly designed and executed, the confirmation process involves obtaining audit evidence regarding specific items from a knowledgeable external source. A knowledgeable external source, as referred to in the new standard, generally is a third party who the auditor believes has knowledge of the information that may be used as audit evidence. To the extent that this objective differs from the objective in standards adopted by other standard-setting bodies on the auditor's use of confirmation, the Board believes it appropriately reflects the Board's approach in the new standard and is consistent with its statutory mandate to protect the interests of investors and further the public interest. The next section of this exhibit further discusses the relationship of the confirmation process to the auditor's identification and assessment of, and response to, the risks of material misstatement.

Relationship of the Confirmation Process to the Auditor's Identification and Assessment of and Response to the Risks of Material Misstatement

(See paragraphs .03–.07 of the new standard).

When an auditor uses confirmation, the auditor should be mindful of, and comply with, the existing obligation to exercise due professional care in all matters relating to the audit.^[29] Due professional care requires the auditor to exercise professional skepticism, which is an attitude that includes a questioning mind and a critical assessment of audit evidence. Professional skepticism should be exercised throughout the audit process,^[30] including when identifying information to confirm, identifying confirming parties, evaluating confirmation responses, and addressing nonresponses. The requirements related to exercising professional skepticism, in combination with requirements in other PCAOB standards, are designed to reduce the risk of confirmation bias, a phenomenon wherein decision makers have been shown to actively seek out and assign more weight to evidence that confirms their hypothesis, and ignore or assign less weight to evidence that could disconfirm their hypothesis.^[31]

The 2022 Proposal described how the proposed standard would work in conjunction with the PCAOB standards on risk assessment. AS 2110 establishes requirements regarding the process of identifying and addressing the risks of material misstatement of the financial statements, and AS 2301, The Auditor's Responses to the Risks of Material Misstatement, establishes requirements regarding designing and implementing appropriate responses to the risks of material misstatement. Fundamental to the PCAOB's risk assessment standards is the concept that as risk increases, so does the amount of evidence that the auditor should obtain.^[32] Further, evidence obtained from a knowledgeable external source generally is more reliable than evidence obtained only from internal company sources.^[33]

Where the auditor uses confirmation as part of the auditor's response, the 2022 Proposal addressed the auditor's responsibilities for designing and executing the confirmation process to obtain relevant and reliable audit evidence. When properly designed and executed, the confirmation process can be an effective and efficient way of obtaining relevant and reliable external audit evidence, including in situations where the auditor identifies an elevated risk of material misstatement due to error or fraud.

The 2022 Proposal also recognized that performing confirmation procedures can effectively and efficiently provide evidential matter about certain financial statement assertions, including existence, occurrence, completeness, and rights and obligations. For example, confirmation may provide audit evidence related to the existence of cash, accounts receivable, and financial instruments, or the completeness of debt. However, the confirmation process generally provides less relevant evidence about the valuation assertion ( e.g., the confirming party may not intend to repay in full the amount owed, or the custodian may not know the value of shares held in custody). Confirmation could also be used to obtain audit evidence about the terms of contractual arrangements ( e.g., by verifying supplier discounts or concessions, corroborating sales practices, or substantiating oral arrangements and guarantees). Information in confirmation responses may indicate the existence of related parties, or relationships or transactions with related parties, previously undisclosed to the auditor.

The Board also observed in the 2022 Proposal that, in some situations, an auditor may determine that evidence obtained through confirmation may constitute sufficient appropriate audit evidence for a particular assertion, while in other situations performing other audit procedures in addition to confirmation may be necessary to obtain sufficient appropriate audit evidence. For example, for significant unusual sales transactions and the resulting accounts receivable balances, an auditor might confirm significant terms of the transactions and the receivable balances with the transaction counterparties and perform additional substantive procedures, such as examination of shipping documents and subsequent cash receipts. Determining the nature, timing, and extent of confirmation procedures, and any other additional audit procedures, is part of designing and implementing the auditor's response to the assessed risk of material misstatement.

The Board adopted the provisions in the 2022 Proposal that address the relationship of the confirmation process to the auditor's identification and assessment of and response to the risks of material misstatement, with certain modifications discussed below.

Overall, commenters expressed support for aligning the proposed standard on confirmation with the PCAOB's existing risk assessment standards. Several commenters stated that they had not identified changes needed to the proposed standard to align further with the PCAOB's risk assessment standards. Other commenters, as discussed below, called for various changes to the proposed provisions:

• Several commenters suggested that there could be further alignment of the 2022 Proposal with the risk assessment standards to enable the level of risk to drive the nature of the audit response. A number of commenters asserted that the 2022 Proposal included certain prescriptive requirements for the confirmation process, regardless of the assessed level of risk, and that those provisions could detract from the auditor's ability to apply professional judgment to determine the appropriate audit response. Consistent with the objective of the new standard, the requirements under the new standard apply to a significant account or disclosure.^[34] The new standard thus does not establish a presumption to confirm cash or accounts receivable if the auditor has not determined cash or accounts receivable to be a significant account. The auditor may choose to perform confirmation procedures, however, in situations other than those specifically addressed in paragraphs .24 through .30 of the new standard. The new standard does not otherwise prescribe the timing or extent of confirmation procedures, which are discussed as part of the auditor's response to the risks of material misstatement in AS 2301.

• Several commenters stated that paragraphs .06 and .07 of the proposed standard overly emphasized confirmation as being the most persuasive substantive audit procedure, with any other procedure thereby viewed as being less persuasive. One commenter asserted that that the 2022 Proposal appeared to be premised on an assumption that third-party confirmations represent “first best” audit evidence, regardless of the facts and circumstances. In addition, one commenter questioned whether the Board intended for confirmation to be used whenever possible to obtain evidence. Having considered these comments, the Board has made several changes in the new standard to clarify certain provisions. In the new standard, the Board has revised paragraph .06, which discusses obtaining audit evidence from knowledgeable external sources, to emphasize the source of the audit evidence, rather than the type of audit procedure performed. The Board understands that advances in technology, as well as changes in attitudes towards confirmation ( e.g., the potential hesitation of confirming parties to reply to a confirmation request from auditors because of the concern of falling victim to a phishing attack), have led auditors to perform other types of audit procedures that can provide relevant and reliable external evidence.

• Some commenters stated that the proposed standard could give rise to unrealistic expectations about confirmation procedures effectively addressing the risk of material misstatement due to fraud in all circumstances. While the Board does not believe that the new standard creates an unrealistic expectation about audit evidence obtained through confirmation, the appropriate focus of the auditor should be the obligation to obtain relevant and reliable audit evidence. Accordingly, the Board did not adopt paragraph .07 of the proposed standard, which had provided that “in situations involving fraud risks and significant unusual transactions, audit evidence obtained through the confirmation process generally is more persuasive than audit evidence obtained solely through other procedures.”
• Several commenters recommended that the standard address the current and anticipated use of technology to enable auditors to obtain sufficient appropriate audit evidence through performing audit procedures other than confirmation. Some commenters provided examples of using technology-based procedures in lieu of confirmations, including accessing company balances directly at the relevant financial institution and testing internal data against external data sources using audit data analytics. The Board considered these comments in developing the new standard. In particular, as discussed below, the new standard includes a presumption for the auditor to confirm cash and accounts receivable, or otherwise obtain relevant and reliable audit evidence for these accounts by directly accessing information maintained by a knowledgeable external source.

• One commenter suggested that the note to paragraph .05 of the proposed standard should also direct the auditor to take into account internal controls over cash, including segregation of duties, when there are side agreements to revenue transactions. The Board did not make this change in the new standard. The Board notes that internal control considerations are addressed by existing PCAOB standards, which require obtaining an understanding of the company's controls when assessing the risk of material misstatement and identifying and testing certain controls when the auditor plans to rely on controls to respond to the assessed risk.^[35] The auditor would consider controls over cash when performing these procedures.

• With respect to the examples of assertions in paragraph .06 of the proposed standard, one commenter asserted that a final standard should more fully explain that a confirmation generally serves to test the assertion of existence, but does not serve to test other assertions such as valuation, including collectability. The Board did not incorporate such language in the new standard because it believes that limiting the use of confirmation to the existence assertion would be overly prescriptive and might disallow use of confirmation in other situations where the auditor has determined that confirmation could be used to obtain relevant and reliable information to test other assertions.

As discussed below, the Board continues to believe that confirmation procedures generally would provide relevant and reliable audit evidence for cash and accounts receivable. Accordingly, under the new standard the auditor should perform confirmation procedures or otherwise obtain relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source when the auditor determines that these accounts are significant accounts. In addition, the new standard specifies that when the auditor has identified a significant risk of material misstatement associated with either a complex transaction or a significant unusual transaction, the auditor should consider confirming those terms of the transaction that are associated with a significant risk of material misstatement, including a fraud risk.

Other Use of Confirmation Procedures. The 2022 Proposal requested commenters' views on whether there were additional accounts or financial statement assertions for which the auditor should be required to perform confirmation procedures. In addition, the 2022 Proposal requested views on whether the proposal was sufficiently flexible to accommodate situations where an auditor chooses to confirm information about newer types of assets ( e.g., digital assets based on blockchain or similar technologies).

Two investor-related groups identified specific types of additional transactions that should be subject to confirmation, including transactions (1) with unusual terms and conditions, (2) with related parties, (3) where the auditor has concern about whether side letters may exist, (4) where financing is obtained, including bank debt or supplier-provided financing, (5) involving certain sales practices, such as bill-and-hold arrangements or supplier discounts or concessions, (6) involving certain oral arrangements or guarantees, or (7) involving sales, lending, or liability for custodianship of digital assets. Another commenter suggested that confirmation of accounts payable should be considered, but not required, when auditors assess controls over the recording of liabilities to be ineffective. This commenter also suggested that the Board state that the use of confirmation is not limited to the circumstances discussed in the proposed standard.

In comparison, many firms and firm-related groups stated that the proposed standard should not prescribe additional other presumptive requirements to use confirmation. These commenters noted that doing so would be unduly prescriptive. Several commenters stated that the proposed standard provided for an appropriate amount of auditor judgment in determining when to perform confirmation procedures in situations other than those specifically addressed in the standard. In addition, several commenters indicated that the 2022 Proposal offered sufficient flexibility to accommodate situations where an auditor confirms information about newer types of assets.

Several commenters asserted that the effectiveness of confirmation procedures is negatively affected by the fact that third parties are not obligated, under legislation or regulation, to reply to an auditor's confirmation request.

The new standard does not specify additional accounts or transactions for which confirmation procedures are presumptively required beyond those in the 2022 Proposal. The PCAOB's risk assessment standards are foundational and are used by the auditor to determine the appropriate response to identified risks of material misstatement. The Board believes that confirmation can be an important tool for addressing certain risks for cash and accounts receivable, and for obtaining audit evidence about other financial relationships, and certain terms of complex transactions or significant unusual transactions, as discussed below. However, identifying additional accounts or scenarios that require the auditor to use confirmation, without regard to the specific facts and circumstances of the audit including the assessed risk of material misstatement and whether other audit procedures would provide sufficient appropriate audit evidence, would be overly prescriptive.

The auditor's responsibilities relevant to the use of confirmation are also addressed in several other PCAOB standards. AS 2315, Audit Sampling, which discusses planning, performing, and evaluating audit samples, is used if the auditor uses sampling in the confirmation process. AS 2510, Auditing Inventories, addresses confirmation of inventories in the hands of public warehouses or other outside custodians. Additionally, the new standard does not address auditor responsibilities regarding inquiries concerning litigation, claims, and assessments, which are addressed in AS 2505, Inquiry of a Client's Lawyer Concerning Litigation, Claims, and Assessments.

Designing Confirmation Requests

(See paragraphs .08–.13 of the new standard).

A properly designed and executed confirmation process may provide relevant and reliable audit evidence. Auditor responsibilities regarding designing a confirmation request are described in paragraphs .08–.13, as follows:

• Paragraph .08 discusses identifying information to confirm;
• Paragraphs .09 through .11 discuss identifying the confirming parties for confirmation requests; and
• Paragraphs .12 through .13 discuss using negative confirmation requests.

The new standard does not prescribe a particular format for a confirmation request. For example, requests could be paper-based or electronic, specifying the information to be confirmed or providing a blank response form, or sent with or without the involvement of an intermediary that facilitates electronic transmission. As a practical matter, the auditor determines the format of a confirmation request to increase the likelihood that the request is received and clearly understood by the confirming party, taking into consideration, among other things, the facts and circumstances of the company and the confirming party.

Identifying Information To Confirm

The 2022 Proposal provided that the auditor should, as part of designing confirmation requests, identify information related to the relevant assertions that the auditor plans to verify with confirming parties or (when using a blank form) obtain from confirming parties. Such information could include transaction amounts, transaction dates, significant terms of transactions, and balances due to or from the confirming party as of a specific date. In addition, the 2022 Proposal discussed that using a blank confirmation request generally provides more reliable audit evidence than using a confirmation request that includes information the auditor is seeking to confirm ( e.g., a customer account balance). In the latter scenario, it is possible that a confirming party could agree to the information without verifying it against the confirming party's records.

The Board adopted the proposed requirement relating to identifying information to confirm with certain modifications discussed below.

Several commenters indicated that the provisions of the 2022 Proposal related to identifying information to confirm were clear and appropriate. A few commenters requested retaining a statement analogous to a statement in existing AS 2310 to emphasize in the standard that responding to blank form confirmation requests generally requires additional effort, which might lower the response rates and lead auditors to perform alternative procedures. One commenter expressed concern that fraudsters could use fake confirmation requests and, in particular, fake blank form confirmation requests, to defraud bank customers ( e.g., by soliciting their bank details).

Existing AS 2310 includes details regarding the form of confirmation requests, which includes general information regarding blank form positive confirmation requests. This information has been included in the new standard in a note to paragraph .08. Further, after considering the comments received, the new standard includes language not included in the proposed standard that is similar to language in existing AS 2310. This language explains that responding to blank form confirmation requests generally requires additional effort, which might lower the response rates and lead auditors to perform alternative procedures for more selected items. Despite the possibility of lower response rates, responses to blank form confirmation requests may provide more reliable audit evidence than responses to confirmation requests using pre-filled forms.

Paragraph .17 of the proposed standard also included a reminder of an existing requirement in AS 1105.10, pursuant to which the auditor should test the accuracy and completeness of information produced by the company that the auditor uses as audit evidence. The reminder emphasized that, in the confirmation process, the requirement in AS 1105.10 applies to the information produced by the company ( e.g., populations from which items are selected for confirmation, such as detailed account listings, vendor listings, and contractual agreements) that the auditor uses in selecting the items to confirm.

Several firms and firm-related groups indicated that the existing requirement in AS 1105.10 for the auditor to evaluate information produced by a company as audit evidence was sufficient and that paragraph .17 of the proposed standard was duplicative. A few commenters stated that confirmation requests are often designed to test the accuracy of a given account balance or disclosure and, accordingly, that the requirement should only focus on testing completeness. Finally, a few commenters suggested that the standard, consistent with AS 1105.10, should allow for the auditor to test controls over the accuracy and completeness of information produced by the company that the auditor uses in selecting items to confirm.

After considering these comments, in order to avoid duplication with other PCAOB standards, the new standard does not include paragraph .17 of the proposed standard.

Identifying Confirming Parties for Confirmation Requests

The 2022 Proposal provided that, to obtain reliable audit evidence from the confirmation process, the auditor should direct the confirmation requests to third parties (individuals or organizations) who are knowledgeable about the information to be confirmed. That provision was similar to existing AS 2310.26, which directs the auditor to send confirmation requests to third parties who the auditor believes are knowledgeable about the information to be confirmed, such as a counterparty who is knowledgeable about a transaction or arrangement.

When designing confirmation requests, an auditor may become aware of information about a potential confirming party's motivation, ability, or willingness to respond, or about the potential confirming party's objectivity and freedom from bias with respect to the audited entity. Because this type of information can affect the reliability of audit evidence provided by the confirming party to the auditor, the 2022 Proposal, similar to existing AS 2310.27, provided that the auditor should consider any such information that comes to the auditor's attention when selecting the confirming parties. The note to paragraph .19 of the proposed standard further emphasized that such information may indicate that the potential confirming party has incentives or pressures to provide responses that are inaccurate or otherwise misleading.^[36]

The 2022 Proposal also provided that the auditor should consider the source of any such information. For example, if management indicates to the auditor that a potential confirming party is unlikely to respond to a confirmation request, management may have other reasons to avoid a confirmation request being sent ( e.g., concealing management's fraudulent understatement of the amount the company owes to that party).

In addition, the 2022 Proposal provided more specific direction than existing AS 2310 for situations in which the auditor is unable to identify a confirming party who, in response to a confirmation request, would provide relevant and reliable audit evidence about a selected item. In such a scenario, the 2022 Proposal prescribed that the auditor should perform alternative procedures.

The 2022 Proposal also provided that the auditor should determine that confirmation requests are properly addressed, thus increasing the likelihood that they are received by the confirming party. The 2022 Proposal did not prescribe the nature or extent of procedures to be performed by the auditor when making this determination, thereby allowing the auditor to tailor the procedures to the facts and circumstances of the audit. For example, in practice, some auditors compare some or all confirming party addresses, which are typically provided by the company, to physical addresses or email domains included on the confirming party's website.

Alternatively, when using an intermediary to facilitate direct electronic transmission of confirmation requests and responses, Appendix B of the proposed standard required the auditor to obtain an understanding of the intermediary's controls that address the risk of interception and alteration of the confirmation requests and responses and determine whether the relevant controls used by the intermediary are designed and operating effectively. The Board noted in the 2022 Proposal that, where an auditor determines that controls that address the risk of interception and alteration also include controls related to validating the addresses of confirming parties, the auditor may be able to determine that audit procedures performed in accordance with Appendix B are sufficient to determine that confirmation requests are properly addressed. In situations where the auditor determines that the intermediary's controls that address the risk of interception and alteration do not also include controls related to validating the addresses of confirming parties, the Board also noted that the auditor would need to perform other procedures to comply with the requirements of the proposed standard.

The Board adopted the requirements relating to identifying confirming parties for confirmation requests as proposed, with certain modifications discussed below.

Several commenters indicated that the provisions of the proposed standard related to identifying confirming parties were sufficiently clear and appropriate. One commenter indicated that the Board should require the auditor to send confirmation requests directly to an individual, rather than allow the auditor to choose between sending the request either to an individual or an organization. In this commenter's view, sending a confirmation request directly to an individual could increase the reliability of audit evidence obtained through the confirmation process. One commenter indicated that the Board should amend paragraph .18 of the proposed standard to read “the auditor should direct confirmation requests to confirming parties (individuals or organizations) who are expected to be knowledgeable about the information to be confirmed and determine that the confirmation requests are appropriately addressed.”

Because auditors often may have no or limited interaction with the personnel of confirming organizations, they may not be able to select an individual addressee for the confirmation request. As a result, the Board believes that allowing the auditor to address a confirmation request to an organization that is knowledgeable about the information to be confirmed is practicable and appropriate. Paragraph .20 of the proposed standard stated that the auditor should perform alternative procedures when the auditor is unable to identify a confirming party who, in response to a confirmation request, would provide relevant and reliable audit evidence about the selected item.

The Board has modified this language, which appears in paragraph .11 of the new standard, to emphasize that if the auditor is unable to identify a confirming party for a selected item who would provide relevant and reliable audit evidence in response to a confirmation request, including considering any information about the potential confirming party discussed in paragraph .10, the auditor should perform alternative procedures in accordance with Appendix C. In addition, the Board has added a note to paragraph .11 of the new standard to reiterate that AS 1105.08 provides that the reliability of evidence depends on the nature and source of the evidence and the circumstances under which it is obtained.

These revisions are intended to underscore that auditors should consider information that may indicate that a potential confirming party has incentives or pressures to provide responses that are inaccurate or misleading, and remind auditors that the reliability of audit evidence depends not only on its nature and source, but also the circumstances under which it is obtained. For example, restrictions on access to a potential confirming party that cause the auditor to identify and send a confirmation request to a different confirming party or to perform alternative procedures may themselves raise questions as to the reliability of the audit evidence that the auditor subsequently obtains from the other confirming party or through performing alternative procedures. In addition, the revisions to paragraph .11 clarify that the paragraph applies to a confirming party for an individual item selected for confirmation, rather than more broadly to a group of confirming parties that might provide audit evidence with respect to relevant assertions for an entire account, such as accounts receivable.

Several commenters on the 2022 Proposal also indicated that the requirement to send a confirmation request directly to the confirming party and determine that the request is properly addressed was sufficiently clear and appropriate. One of these commenters indicated that the standard should address procedures to verify the recipient's mailing or email address while the other commenters indicated there was no need to include specific procedures in the standard. Another commenter requested more guidance around verifying email addresses. One commenter indicated that there should be no specific requirement to check addresses, as such a requirement would not, in the commenter's view, deter those intent on deceiving auditors. Lastly, one commenter requested clarification as to whether an auditor should send either an initial confirmation request or a second request when the auditor is aware of information that indicates that the confirming party would be unlikely to respond.

The Board continues to believe that requiring auditors to determine that confirmation requests are appropriately addressed is critically important to the effectiveness of the confirmation process. The Board has noted above some of the ways in which an auditor might comply with this requirement but is not including such examples in the text of the new standard to avoid the possible misinterpretation that the examples describe the only steps an auditor could take in determining whether a confirmation request is properly addressed.

With respect to one commenter's suggestion that the Board clarify whether an auditor should send a confirmation request if the auditor is aware of information indicating that the confirming party would not respond, the Board believes the new standard is sufficiently clear. Paragraph .10 of the new standard states, in part, that if the auditor is aware of information about a potential confirming party's “willingness to respond,” the auditor should consider this information, including its source, in selecting the confirming parties. Further, paragraph .11 of the new standard states that, if the auditor is unable to identify a confirming party for a selected item who would provide relevant and reliable audit evidence in response to a confirmation request, the auditor should perform alternative procedures for the selected item in accordance with Appendix C of the new standard.

Using Negative Confirmation Requests

There are “positive” and “negative” types of confirmation requests. A positive confirmation request is a confirmation request in which the auditor requests a confirmation response. With a negative confirmation request, the auditor requests a confirmation response only if the confirming party disagrees with the information provided in the request. The auditor generally obtains significantly less audit evidence when using negative confirmation requests than when using positive confirmation requests. A confirming party might not respond to a negative confirmation request because it did not receive or open the request, or alternatively the confirming party might have read the request and agreed with the information included therein.

Because of the limited evidence provided when using negative confirmation requests, the 2022 Proposal provided that the auditor may not use negative confirmation requests as the sole substantive procedure for addressing the risk of material misstatement to a financial statement assertion. Instead, the 2022 Proposal provided that the auditor may use negative confirmation requests only to supplement audit evidence provided by other substantive procedures ( e.g., examining subsequent cash receipts, including comparing the receipts with the amounts of respective invoices being paid; examining shipping documents; examining subsequent cash disbursements; or sending positive confirmation requests). In addition, Appendix B to the proposed standard provided examples of situations in which the use of negative confirmation requests, in combination with the performance of other substantive audit procedures, may provide sufficient appropriate audit evidence. In contrast, under existing AS 2310, the auditor may use negative confirmation requests where certain criteria are present and should consider performing other substantive procedures to supplement their use.

The Board adopted the requirements for using negative confirmation requests as proposed. Most commenters on this aspect of the 2022 Proposal expressed support for the proposed prohibition on using negative confirmation requests as the sole substantive procedure with a number of commenters stating that negative confirmation requests alone do not provide sufficient appropriate audit evidence.

Another commenter suggested that the word “generally” should be removed from paragraph .21 of the proposed standard to emphasize that a negative confirmation is not as persuasive as a positive confirmation. This commenter indicated that, in situations where the use of negative confirmation requests, in combination with the performance of other substantive audit procedures, may provide sufficient appropriate audit evidence, auditors should be required to specifically document their consideration of certain examples included in paragraph .B1 of the proposed standard.

Lastly, a few commenters indicated that additional guidance on the use of negative confirmations, and specifically on the use of substantive analytical procedures to supplement the use of negative confirmations, was needed while another commenter indicated that the examples in Appendix B would assist auditors in applying the requirements related to the use of negative confirmation requests.

After considering the comments on the 2022 Proposal, the Board has determined that the requirements in the 2022 Proposal relating to the use of negative confirmation requests are both appropriate and sufficiently clear. For ease of reference, the examples of situations in which the use of negative confirmation requests, in combination with the performance of other substantive audit procedures, may provide sufficient appropriate audit evidence now appear in paragraph .13 of the new standard rather than Appendix B. The Board is not including in the new standard additional examples of other substantive procedures that may be used to supplement negative confirmation requests, as some commenters had suggested. While such procedures may be appropriate in some circumstances, including such examples in the new standard could be misperceived as establishing a formal checklist, whereas determining the necessary nature, timing, and extent of audit procedures that provide sufficient appropriate audit evidence would depend on the facts and circumstances of each audit.

Paragraph .12 of the new standard retains the word “generally” ( i.e., “[g]enerally, the auditor obtains significantly less audit evidence when using negative confirmation requests than when using positive confirmation requests”) to acknowledge that in some circumstances using positive confirmations may not provide the auditor with the amount of evidence that the auditor planned to obtain ( e.g., if the auditor does not receive responses to some or all positive confirmation requests).

Maintaining Control Over the Confirmation Process

(See paragraphs .14–.17 and .B1–.B2 of the new standard).

The Requirement for the Auditor To Maintain Control Over the Confirmation Process

The 2022 Proposal included a provision, consistent with AS 2310, that the auditor should maintain control over the confirmation process to minimize the likelihood that information exchanged between the auditor and the confirming party is intercepted and altered. This is because the reliability of audit evidence provided by confirmation depends in large part on the auditor's ability to control the integrity of confirmation requests and responses. The 2022 Proposal also provided that, as part of maintaining control, the auditor should send confirmation requests directly to the confirming party and receive confirmation responses directly from the confirming party.

The Board adopted the requirements for maintaining control over the confirmation process as proposed, with one modification.

Commenters on this topic largely agreed that the auditor should maintain control over the confirmation process. One commenter stated that setting forth the requirement to maintain control over the confirmation process and the requirement to send confirmation requests directly to the confirming party in separate paragraphs might suggest that there are different responsibilities for the auditor. This commenter recommended combining the requirements to clarify that the auditor's responsibility is to send the confirmation directly while maintaining control of the process.

After considering the comments on the 2022 Proposal, the Board has determined that the proposed requirements are both appropriate and sufficiently clear, and adopted them as proposed, with the addition of a new paragraph that clarifies how an external auditor can use internal auditors in a direct assistance capacity as part of the confirmation process, as further discussed below. Paragraph .14 of the new standard establishes the auditor's responsibility for maintaining control over the confirmation process, and the other paragraphs in this section of the new standard specify auditor responsibilities regarding certain aspects of maintaining control, as discussed below. For example, consistent with the definition of “confirmation process,” ^[37] paragraph .15 of the new standard requires that the auditor select the items to be confirmed, send the confirmation requests and receive the confirmation responses. Selecting an item involves the auditor identifying the information to be included on the confirmation request. Paragraph .16 of the new standard specifies that maintaining control over the confirmation process by the auditor involves sending the confirmation request directly to and obtaining the confirmation response directly from the confirming party.

Using and Intermediary To Facilitate Direct Electronic Transmission of Confirmation Requests and Responses

Background and Requirements

As discussed above, certain financial institutions and other companies have adopted the policy of responding to electronic confirmation requests from auditors only through another party that they, or the auditor, engage as an intermediary to facilitate the direct transmission of information between the auditor and the confirming party. The Board understands that such policies are intended to facilitate the timeliness and quality of confirmation responses provided by the confirming party to the auditor.

While the involvement of intermediaries is not discussed in existing AS 2310, the use of an intermediary does not relieve the auditor of the responsibility under PCAOB standards to maintain control over confirmation requests and responses. Because an intermediary's involvement may affect the integrity of information transmitted between the confirming party and the auditor, the 2022 Proposal provided that the auditor should evaluate the implications of such involvement for the reliability of confirmation requests and responses. Specifically, paragraphs .B2 and .B3 of the proposed standard provided that:

• The auditor's evaluation should address certain aspects of the intermediary's controls that address the risk of interception and alteration of communications between the auditor and the confirming party;

• The auditor's evaluation should assess whether circumstances exist that give the company the ability to override the intermediary's controls ( e.g., through financial or other relationships); and

• The auditor should not use an intermediary if information obtained by the auditor indicates that (i) the intermediary has not implemented controls that are necessary to address the risk of interception and alteration of the confirmation requests and responses, (ii) the necessary controls are not designed or operating effectively, or (iii) circumstances exist that give the company the ability to override the intermediary's controls.

The Board adopted the proposed requirements substantially as proposed, with certain modifications discussed below.

A few commenters on the 2022 Proposal indicated that it is not clear what an “intermediary” is and requested clarification. The Board is not adding a definition of the term “intermediary” in the new standard as it simply intends to use the term in describing a particular scenario under the new standard where a third party is engaged by the auditor or a confirming party to facilitate direct electronic transmission of confirmation requests and responses between the auditor and the confirming party. The Board believes that its intent in using the term “intermediary” is sufficiently clear.

Overall, several commenters indicated that the requirements in the 2022 Proposal to evaluate the implications of using an intermediary to facilitate direct electronic transmission of confirmation requests and responses were appropriate. However, as discussed below, a number of these commenters and other commenters stated that additional clarity may be required to ensure that the proposed revisions are operational in practice, or otherwise requested additional guidance. Conversely, a few commenters expressed the view that requirements in the 2022 Proposal regarding the implications of using an intermediary were not appropriate or sufficiently clear. One of those commenters asserted that the requirement to assess the intermediary would result in significant additional work for auditors and that it is not currently common practice to directly assess intermediaries in this manner. As discussed in Section IV of the 2022 Proposal, firm methodologies reviewed by the staff generally include guidance on maintaining control over the confirmation process, using intermediaries to facilitate the electronic transmission of confirmation requests and responses, and assessing controls at the intermediaries. The evidence from the PCAOB staff's review does not suggest that the requirements in Appendix B of the new standard would create significant additional work for auditors, nor did the commenters provide evidence to the contrary.

Separately, as the 2022 Proposal provided that the auditor should not use an intermediary if information obtained by the auditor indicates that certain conditions are present, several commenters stated that the presence of indicators would not necessarily mean that the intermediary is not fit for use. For example, these commenters stated that in a situation where an intermediary's control is not designed or operating effectively, an auditor may be able to obtain an understanding of whether a specific control failure impacts the confirmation process and perform tests of other controls or other procedures at the intermediary to address the control failure.

Having considered the comments, the Board is clarifying in paragraph .B2 of the new standard that the auditor should not use an intermediary to send confirmation requests or receive confirmation responses if the auditor determines that (1) the intermediary has not implemented controls that are designed or operating effectively to address the risk of interception and alteration of the confirmation requests and responses and the auditor cannot address such risk by performing other procedures beyond inquiry, or (2) circumstances exist that give the company the ability to override the intermediary's controls. In the 2022 Proposal, the prohibition was based on an indication, rather than determination, that such circumstances exist.

For example, when performing an evaluation required by paragraphs .17 and .B1 of the new standard, an auditor could obtain a SOC report stating that a particular access control at an intermediary is not designed or operating effectively. The auditor may then be able to identify and test other controls that could mitigate the control failure described in the SOC report. In this scenario, if the auditor determines that the identified controls are designed and operating effectively and mitigate the control failure, or the auditor has performed other procedures such as obtaining computer systems event logs generated by the intermediary that provide evidence there was no unauthorized access during the relevant period, the information in the SOC report in this scenario would not necessarily mean that the auditor is not allowed to use the intermediary under the new standard.

In addition, several commenters asserted that, if an auditor were not allowed to use an intermediary under proposed paragraph .B3 and the confirming party had a policy requiring the use of an intermediary for receiving and responding to auditor confirmation requests, an auditor may be unable to comply with the proposed requirement to confirm cash, even if relevant and reliable audit evidence were otherwise available. Considering these comments, the Board has modified paragraph .B2 of the new standard to state that in circumstances where the auditor, under paragraph .B2, should not use an intermediary to send confirmation requests or receive confirmation responses, the auditor should send confirmation requests without the use of an intermediary or, if unable to do so, perform alternative procedures in accordance with Appendix C of the new standard. The Board believes that this modification and the adoption of a provision regarding obtaining audit evidence by directly accessing information maintained by a knowledgeable external source (see discussion below), address commenters' concerns that an auditor may not be able to comply with the requirement to confirm cash.

Certain commenters asked for additional guidance on what procedures an auditor should or could perform to comply with the requirements in Appendix B. Having considered these comments, the Board determined that the new standard, consistent with the 2022 Proposal, will not specify how the auditor should perform the particular procedures required by paragraphs .B1 and .B2 regarding evaluating the implications of using an intermediary. The new standard thus allows auditors to customize their approach based on the facts and circumstances of the audit engagement and the audit firm. For example, in obtaining an understanding of the intermediary's controls that address the risk of interception and alteration of confirmation requests and responses and determining whether they are designed and operating effectively, the auditor could (i) use, where available, a SOC report that evaluates the design and operating effectiveness of the relevant controls at the intermediary; or (ii) test the intermediary's controls that address the risk of interception and alteration directly.^[38]

Some commenters asked for guidance related to an acceptable window of time to be covered by “bridge letters.” ^[39] Where an auditor uses an independent service auditor's report on a service organization's controls, such procedures may involve using a bridge letter. The new standard does not specify an appropriate window of time to be covered by a bridge letter or a permissible window of time between the date covered by a bridge letter and the period when the auditor uses the intermediary to facilitate direct electronic transmission of confirmation requests and responses. Auditors should use their professional judgment based upon the facts and circumstances of the audit to determine the nature of procedures required to comply with paragraph .B1 of the new standard, including the note to paragraph .B1(b).

One commenter stated that paragraph .B2(b) of the proposed standard should have a specific documentation requirement. The Board believes that adding a specific documentation requirement is not necessary, as the auditor is required to document compliance with PCAOB standards under existing documentation requirements.^[40]

Lastly, the new standard modifies the language of the 2022 Proposal to provide in the note to paragraph .B1(b) of the new standard that, if the auditor performs procedures to determine that the controls used by the intermediary to address the risk of interception and alteration are designed and operating effectively at an interim date, the auditor should evaluate whether the results of the procedures can be used “during the period in which the auditor uses the intermediary”—rather than at “period end,” as described in the proposed standard—or whether additional procedures need to be performed to update the results. The Board believes that the modified provision more accurately describes the timeframe during which the results of the procedures may be used by an auditor. In addition, the modified provision clarifies that the auditor should consider the nature and extent of any changes in the intermediary's process and controls during the period between the auditor's procedures and the period the auditor uses the intermediary.

Interaction of New Standard and Proposed QC 1000

In November 2022 the Board issued for public comment a proposed quality control standard, referred to as proposed QC 1000, A Firm's System of Quality Control.^[41] Proposed QC 1000 addresses resources used by a registered public accounting firm that are sourced from third-party providers. An intermediary that facilitates direct electronic transmission of confirmation requests and responses is one example of a “third-party provider” under proposed QC 1000.

Under proposed QC 1000, a firm would consider the nature and extent of resources or services obtained from third-party providers in its risk assessment process and whether the use of third-party providers poses any quality risks to the firm in achieving its quality objectives. One of the required quality objectives relates to obtaining an understanding of how such resources or services are developed and maintained and whether they need to be supplemented and adapted as necessary, such that their use enables the performance of the firm's engagements in accordance with applicable professional and legal requirements and the firm's policies and procedures.^[42]

As noted above, the proposed standard on the auditor's use of confirmation included specific procedures related to the use of an intermediary, which included obtaining an understanding of the intermediary's controls that address the risk of interception and alteration of a confirmation request and response and determining whether such controls are designed and operating effectively.

A few commenters on the 2022 Proposal observed that firms may obtain and evaluate SOC reports centrally, rather than requiring that individual engagement teams obtain and evaluate the reports. One of these commenters suggested clarifying in the standard that the evaluations required by Appendix B may be performed, and the documentation may be retained centrally, as part of the firm's quality control system. Another of these commenters suggested that the requirements related to the use of an intermediary be removed entirely from the proposed confirmation standard and instead be dealt with solely in the proposed quality control standards. One commenter stated that, depending on the identified quality risks, procedures performed in accordance with QC 1000 need not align with the financial statement period-end of each audit engagement performed by the firm, which the commenter asserted was implied by paragraph .B2(b) and a related note in the proposed standard. Lastly, a few commenters indicated that it would be beneficial to explicitly link the provisions of the confirmation standard regarding the use of an intermediary with QC 1000.

Having considered these comments, the Board believes that the requirements in the new standard related to the auditor's use of intermediaries, with the modifications discussed above to the requirements in the proposed standard, are sufficiently clear and appropriate. The auditor's evaluation of the intermediary's controls could be performed by an engagement team, an audit firm's national office, or a combination of both. Where the national office performs procedures relating to the intermediary (either as part of the firm's quality control activities or specifically to comply with the new standard), the engagement team would still need to consider the procedures performed by the national office and include in its audit documentation considerations specific to the individual audit engagement. For example, if a national office evaluated an intermediary's controls at an interim date, the engagement team would need to, in accordance with the note accompanying paragraph .B1(b) of the new standard, evaluate whether the results of the interim procedures could be used during the period in which the auditor uses the intermediary to facilitate direct electronic transmission of confirmation requests and responses or whether they needed to be updated.

Using Internal Audit in the Confirmation Process

The 2022 Proposal identified certain activities in the confirmation process where the auditor may not use the assistance of the company's internal audit function. Under the 2022 Proposal, the auditor was not permitted to use internal auditors for selecting items to be confirmed, sending confirmation requests, and receiving confirmation responses, because using internal audit in a direct assistance capacity for such activities would not be consistent with the auditor's responsibility to maintain control over the confirmation process.

Existing AS 2310 does not include analogous provisions. It states instead that the auditor's need to maintain control does not preclude the use of internal auditors and that AS 2605, Consideration of the Internal Audit Function, provides guidance on considering the work of internal auditors and on using internal auditors to provide direct assistance to the auditor.^[43]

The Board adopted the proposed requirements substantially as proposed, with certain modifications discussed below.

A number of commenters, including investor-related groups, firms, and firm-related groups, agreed with the requirements proposed in the 2022 Proposal as being in line with the auditor's responsibility to maintain control over the confirmation process. Additionally, a few commenters observed that it is not current practice for auditors to use internal audit in a direct assistance capacity for selecting items to be confirmed, sending confirmation requests, or receiving confirmation responses and, therefore, that the requirements in the 2022 Proposal would not result in a significant change in practice. Conversely, one commenter stated that the proposed restrictions would impact current practice as it relates to direct assistance.

A significant number of commenters, including internal auditors and companies with internal audit functions, took exception to the provision in the 2022 Proposal to limit the external auditor's use of internal auditors in a direct assistance capacity in the confirmation process, and in some instances asserted that such limitations would be inconsistent with AS 2605. Many of these commenters also challenged the statement in the 2022 Proposal that “[i]nvolving internal auditors or other company employees in these activities [selecting items to be confirmed, sending confirmation requests, and receiving confirmation responses] would create a risk that information exchanged between the auditor and the confirming party is intercepted and altered.” These commenters asserted that this language called into question internal auditors' competence, objectivity, and independence. Additionally, a few commenters expressed concern with the prescriptiveness of the proposed restrictions on the use of internal auditors in the confirmation process.

Having considered the comments received, the Board notes that the discussion in the 2022 Proposal was not intended to cast doubt on the qualifications, competence, or objectivity of internal auditors. Internal auditors can and often do play an important role in enhancing the quality of a company's financial reporting. At the same time, the Board continues to believe that in order to maintain control over the confirmation process the auditor should select items to be confirmed, send confirmation requests, and receive confirmation responses.

In addition, after considering the comments received, the Board is (i) relocating the requirements related to the auditor's use of internal audit in the confirmation process to the section of the new standard on maintaining control over the confirmation process and (ii) rephrasing the requirements in terms of the auditor's affirmative responsibilities, by describing procedures the auditor is required to perform. In contrast, the proposed standard described procedures that internal auditors were not allowed to perform. As stated in footnote 7 of the new standard, auditors are permitted to use internal auditors in accordance with AS 2605, except for selecting items to confirm, sending confirmation requests, and receiving confirmation responses. The new standard does not impose any new limitations on how the internal auditors' work may affect the external auditor's audit procedures.^[44] Instead, the new standard clarifies how an external auditor can use internal auditors in a direct assistance capacity as part of the confirmation process.^[45]

Evaluating Confirmation Responses and Confirmation Exceptions, and Addressing Nonresponses and Incomplete Responses

(See paragraphs .18–.23 of the new standard).

Overall Approach

Under the 2022 Proposal, the auditor's responsibilities related to the confirmation process included evaluating the information received in confirmation responses and addressing nonresponses and incomplete responses. The 2022 Proposal provided that if the auditor is unable to determine whether the confirmation response is reliable, or in the case of a nonresponse or an incomplete response ( i.e., one that does not provide the audit evidence the auditor seeks to obtain), the auditor should perform alternative procedures.^[46] The 2022 Proposal built upon requirements in existing AS 2310 that discuss addressing information obtained from the performance of confirmation procedures.

The relevant requirements in the new standard include certain modifications to the approach in the 2022 Proposal, as discussed in the sections below.

Evaluating the Reliability of Confirmation Reponses

The 2022 Proposal was intended to provide additional direction beyond what is set forth in existing AS 2310 to assist the auditor's evaluation of the reliability of confirmation responses. Specifically, the 2022 Proposal (i) described information that the auditor should take into account when performing the evaluation, and (ii) provided examples of indicators that a confirmation response may have been intercepted or altered and thus may not be reliable. In particular, the 2022 Proposal provided that the auditor should take into account any information about events, conditions, or other information the auditor becomes aware of in assessing the reliability of the confirmation response.

Under existing PCAOB standards, the auditor is not expected to be an expert in document authentication but, if conditions indicate that a document ( e.g., a confirmation response) may not be authentic or may have been altered, the auditor should modify the planned audit procedures or perform additional audit procedures to respond to those conditions and should evaluate the effect, if any, on the other aspects of the audit.^[47] The 2022 Proposal did not alter these requirements, but specified for the confirmation process that, if the auditor were unable to determine that the confirmation response is reliable, the auditor's response should include performing alternative procedures.

The requirements for evaluating the reliability of confirmation responses were adopted substantially as proposed.

Several commenters indicated that the provisions of the 2022 Proposal related to evaluating the reliability of confirmation responses were clear and appropriate. One commenter proposed modifications to the proposed requirements, including replacing the words “taking into account” with “considering” in paragraph .25 of the proposed standard to reflect the commenter's perceived intent of the Board. One commenter asserted that paragraph .25 of the proposed standard could result in onerous documentation requirements in situations where there is a clear reason why a particular indicator is not necessarily indicative of interception or alteration of a confirmation request or confirmation response ( e.g., a confirmation request is sent to a general email account but returned from an email account belonging to an individual monitoring the general email account). Another commenter proposed that the Board remove one of the examples of indicators that a confirmation response may have been intercepted or altered because it appeared to create a de facto requirement that an auditor treat a confirmation response as not reliable if the original confirmation request is not returned with the confirmation response.

In addition, one commenter suggested modifying proposed paragraph .26 of the proposed standard to provide that the auditor should perform alternative procedures if the auditor became aware of any of the factors identified in paragraph .25 and was unable to overcome those factors to determine that the confirmation response is reliable. Another commenter stated that the proposed standard should acknowledge that, in certain specified circumstances, an unreliable confirmation would likely result in a scope limitation.

Having considered the comments received, the Board notes that assessing the reliability of confirmation responses is a critical component of the confirmation process. If indicators of interception or alteration are present, it is important for the auditor to address them. When the auditor follows up on a particular indicator, an auditor may determine that the confirmation requests and responses have not been intercepted or altered. For example, an auditor could verify that a difference in the confirming party's email address between the confirmation request and confirmation response occurred because the confirming party responds to confirmation requests from one central email address. The note to paragraph .18 of the new standard (paragraph .25 of the proposed standard) provides examples of information that the auditor should take into account if the auditor becomes aware of it. Under PCAOB standards, the auditor would document the procedures performed in response to information that indicates that a confirmation request or response may have been intercepted or altered. To minimize any confusion, the Board replaced the word “indicator” in the note with the phrase “information that indicates,” which has the same meaning.

In addition, to clarify that the auditor performs alternative procedures for the selected item if the auditor is unable to determine that a confirmation response regarding that item is reliable, the Board has added the phrase “for the selected item” after the words “alternative procedures” in paragraph .19 of the new standard. The Board also revised the reference in paragraph .26 of the proposed standard to performing alternative procedures “as discussed in paragraph .31” to “in accordance with Appendix C” in paragraph .19 of the new standard to reflect that alternative procedures for a selected item may not be necessary under certain circumstances, as discussed below, and to reflect the relocation of the more detailed discussion of alternative procedures from the body of the standard to Appendix C.

AS 3105, Departures from Unqualified Opinions and Other Reporting Circumstances, sets forth requirements regarding limitations on the scope of an audit,^[48] including scope limitations relating to confirmation procedures with respect to accounts receivable.^[49] One example of such a scope limitation would be the auditor's inability to confirm accounts receivable balances combined with an inability to perform other procedures in respect of accounts receivable to obtain sufficient appropriate audit evidence. The new standard does not repeat such existing requirements, as doing so would merely duplicate those requirements.

Evaluating Confirmation Exceptions and Addressing Nonresponses and Incomplete Responses

For various reasons, information in a confirmation response received by the auditor could differ from other information in the company's records obtained by the auditor. The 2022 Proposal provided that the auditor should evaluate the confirmation exceptions and determine their implications for certain aspects of the audit, as discussed below. The direction in the 2022 Proposal was more detailed than in existing AS 2310.

In particular, the 2022 Proposal provided that the auditor should evaluate whether confirmation exceptions individually or in the aggregate indicate a misstatement that should be evaluated in accordance with AS 2810. The 2022 Proposal did not, however, require investigating all confirmation exceptions to determine the cause of each confirmation exception. The 2022 Proposal also included a provision that the auditor should evaluate whether the confirmation exceptions individually, or in the aggregate, indicate a deficiency in the company's internal control over financial reporting (“ICFR”).

With regards to nonresponses and potential nonresponses, the 2022 Proposal provided that the auditor should send a second positive confirmation request to the confirming party unless the auditor has become aware of information that indicates that the confirming party would be unlikely to respond to the auditor. Additionally, the 2022 Proposal specified that if a confirmation response is returned by the confirming party to anyone other than the auditor, the auditor should contact the confirming party and request that the response be re-sent directly to the auditor. If the auditor does not subsequently receive a confirmation response from the intended confirming party, the 2022 Proposal provided that the auditor should treat the situation as a nonresponse.

Further, in contrast with existing AS 2310, which does not address the auditor's responsibilities regarding incomplete responses, the 2022 Proposal provided that the auditor should perform alternative procedures if a confirmation response is not received or is incomplete.

The Board adopted the requirements for evaluating confirmation exceptions and addressing nonresponses as proposed, with certain modifications discussed below.

Some commenters indicated that the proposed provisions regarding evaluating confirmation exceptions and addressing nonresponses were sufficiently clear and appropriate. A few commenters stated that the Board should include requirements that limit an auditor's ability to assess confirmation exceptions as merely “isolated exceptions.” Similarly, one commenter asserted that the Board should require auditors to resolve any confirmation exceptions by examining other third-party evidence such as purchase orders. In light of these comments, the Board has added a new note to paragraph .20 of the new standard that states that determining that a confirmation exception does not represent a misstatement that should be evaluated in accordance with AS 2810 generally involves examining external information, which may include information that the company received from knowledgeable external sources.

In the Board's view, in many circumstances examining external evidence under the above provision is necessary, as doing so is consistent with both the goal of obtaining relevant and reliable audit evidence and the type of audit evidence sought from confirmation. For example, an auditor might send a confirmation request for a selected item to a knowledgeable confirming party regarding a $20,000 accounts receivable invoice and the confirming party ( i.e., the customer) indicates that the outstanding balance for this invoice at the date specified in the confirmation request is $18,000. Having investigated the $2,000 difference, the auditor learns that it does not represent a misstatement, as the customer overpaid for a different invoice but applied the overpayment to the invoice selected for confirmation and the company applied the overpayment differently. In this scenario, determining that there is not a $2,000 misstatement for the selected item would involve the auditor examining audit evidence from knowledgeable external sources, such as applicable purchase orders and customer cash payments, in addition to information generated by the company, such as customer invoices.

The note to paragraph .20 of the new standard uses the word “generally” to acknowledge that in some circumstances examining external audit evidence may not be necessary. For example, an auditor may have included an incorrect figure in the confirmation request and later determined that the amount confirmed by the confirming party agrees to the amount in the company's general ledger. Determining that such a confirmation exception does not represent a misstatement to be evaluated in accordance with AS 2810 would not require examining audit evidence from external sources.

One commenter suggested that the Board consider reminding auditors that, when using audit sampling, the auditor should project the misstatement results of the sample to the items from which the sample was selected in accordance with AS 2315. The Board considered this comment, but did not add a reminder regarding projecting the results of a sample as the new standard states in footnote 4 that AS 2315 addresses evaluating audit samples.

One commenter suggested that the Board restructure paragraph .27 of the proposed standard, as the auditor generally considers whether a confirmation exception is a misstatement and then determines whether there is a deficiency in internal control. In consideration of this comment, the Board has restructured paragraph .20 of the new standard to align with the typical order in which the auditor considers the two matters discussed therein ( i.e., an auditor typically considers whether a confirmation exception indicates a misstatement that should be evaluated in accordance with AS 2810, Evaluating Audit Results, and then considers whether the confirmation exception represents a deficiency in the company's ICFR).

One commenter expressed the view that the Board should not require auditors to evaluate whether a confirmation exception constitutes a control deficiency if the exception was a result of a clerical error or caused by a timing difference. The Board continues to believe that requiring the auditor to evaluate exceptions in such circumstances is appropriate and the auditor should consider whether all confirmation exceptions are control deficiencies. A clerical error or timing difference could be indicative of a deficiency in a company's ICFR.

One commenter indicated that the proposed requirement about sending a second positive confirmation request unless the auditor has become aware of information that indicates that the confirming party would be unlikely to respond to the auditor was sufficiently clear and appropriate. However, several firms commented that the requirement was too prescriptive, with one commenter asserting that the requirement could result in unnecessary and potentially ineffective administrative effort. Additionally, a few commenters expressed concern that following up on a confirmation request would not constitute sending a second confirmation request under the proposed standard, but asserted that it should be so treated.

The Board considered the comments about the requirement to send a second positive confirmation request. The use of confirmation is not required under the new standard other than for cash and accounts receivable when they are significant accounts or disclosures. Under the new standard, for cash and accounts receivable, the auditor may perform other audit procedures to obtain audit evidence by directly accessing information maintained by a knowledgeable external source. Further, for accounts receivable, in certain situations the new standard allows the auditor to obtain external information indirectly (see discussion of cash and accounts receivable below).

Because the auditor may have a choice of the audit procedure to perform, the Board believes that the auditor will select confirmation in those situations where confirming parties will be more likely to respond to the auditor. In situations where a confirming party does not respond to a confirmation request, the Board has concluded it is appropriate to require the auditor, in the case of a nonresponse to a positive confirmation request, to follow up with the confirming party. The requirement to follow up with the confirming party is included in paragraph .21 of the new standard. The new standard does not prescribe a form of the auditor's follow-up. For example, following up using the same form of communication as in the original confirmation request ( e.g., email, direct electronic transmission facilitated by an intermediary) would be appropriate under the new standard. In the case of an electronic confirmation request, a follow-up request could be in the form of a reminder or automated reminder.

If the auditor subsequently receives a confirmation response, the new standard provides that the auditor should evaluate that response in accordance with paragraphs .18–.19 and evaluate any confirmation exception in accordance with paragraph .20. If the auditor's follow-up does not elicit a confirmation response, paragraph .23 of the new standard instructs the auditor to perform alternative procedures for the selected item in accordance with Appendix C of the new standard.

To clarify that the auditor performs alternative procedures for the selected item, the Board has added the phrase “for the selected item” after the words “alternative procedures” in paragraph .23 of the new standard. The Board also revised the reference in paragraph .30 of the proposed standard to performing alternative procedures “as discussed in paragraph .31” to refer to “in accordance with Appendix C” in paragraph .19 of the new standard to reflect that alternative procedures for a selected item may not be necessary under certain circumstances, as discussed below, and to reflect the relocation of the more detailed discussion of alternative procedures from the body of the standard to Appendix C.

Additional Considerations for Cash, Accounts Receivable, and Terms of Certain Transactions

(See paragraphs .24–.30 of the new standard).

In general, evidence obtained from a knowledgeable external source is more reliable than evidence obtained only from internal company sources. When cash or accounts receivable are significant accounts, there is a presumption in the new standard that the auditor should obtain audit evidence from a knowledgeable external source by performing confirmation procedures or using other means to obtain audit evidence by directly accessing information maintained by knowledgeable external sources. In addition, the new standard addresses other situations in which the auditor should consider the use of confirmation.

The Board discusses below the provisions of the new standard relating to confirming cash held by third parties, confirming accounts receivable, performing other audit procedures for accounts receivable when obtaining audit evidence directly from a knowledgeable external source would not be feasible, communicating with the audit committee in certain situations, and confirming the terms of certain other transactions. To improve the flow of the requirements in the new standard, these provisions have been placed after the general provisions that describe the auditor's responsibilities related to the confirmation process ( i.e., after paragraphs .08–.23).

Figure 1 depicts the relationship of the requirements in the new standard for cash and accounts receivable when they are significant accounts (paragraphs .24–.28) to the general provisions of the new standard applicable to the confirmation process (paragraphs .08–.23).^[50]

Cash Held by Third Parties

Confirming Cash

The 2022 Proposal provided that the auditor should perform confirmation procedures when auditing cash and cash equivalents held by a third party. Existing AS 2310 does not address auditor responsibilities for confirming cash.

The Board noted in the 2022 Proposal that an auditor need not necessarily confirm all cash accounts in all cases. Under PCAOB standards, the alternative means of selecting items for testing are selecting all items, selecting specific items, and audit sampling.^[51] An auditor selects individual cash items to confirm following the relevant direction in PCAOB standards, including identifying and assessing the risk of misstatement and developing an audit response.^[52] The particular means or combination of means of selecting cash items to confirm depend on, for example, the characteristics of the cash items and the evidence necessary to address the assessed risk of material misstatement.^[53]

The 2022 Proposal emphasized that, in selecting the individual items of cash to confirm, the auditor should take into account the auditor's understanding of the company's cash management and treasury function, and the substance of the company's arrangements and transactions with third parties. For example, an auditor might select bank accounts with balances over a certain amount, accounts with a high volume of transactions, accounts opened or closed during the period under audit, or accounts the auditor identifies as particularly risk-prone. Alternatively, the auditor might determine it is appropriate to confirm all cash accounts. The auditor also follows the direction in PCAOB standards when determining whether performing procedures in addition to confirmation is necessary to address the assessed risk of material misstatement relating to cash.^[54]

The Board adopted the proposed requirements to confirm cash, with certain modifications discussed below.

A number of commenters supported the proposed requirement for the auditor to confirm cash held by third parties. Some of these commenters stated that confirming cash has long been an audit best practice and that requiring cash confirmation would lead to more consistency in practice. In addition, several commenters stated that the standard was sufficiently risk-based ( i.e., by allowing the auditor to select cash accounts and other financial relationships to confirm based on the risk of material misstatement associated with cash).

Several commenters asserted that a requirement to confirm cash was not sufficiently risk-based, despite the provisions in the 2022 Proposal that described that the auditor should take into account their understanding of the company's operations in making selections of individual cash items to confirm. In particular, several commenters stated that the proposed standard would require an auditor to confirm cash without regard to the level of risk that the auditor had determined for cash in their risk assessment or when other audit procedures could produce sufficient appropriate audit evidence. Other commenters expressed the view that the requirement to confirm cash, as well as accounts receivable, should be removed, with some of these commenters suggesting that the auditor should be able to determine the audit procedure that would be most effective in obtaining relevant and reliable audit evidence, without confirmation being the “default” procedure.

The Board continues to believe that a presumption to confirm cash is appropriate. As discussed above, this presumption to confirm cash is consistent with current practice. Consistent with the objective of the new standard, the requirement to confirm cash, as well as accounts receivable, only applies when the auditor has determined that that these accounts are significant accounts.

With respect to confirming cash, many commenters, primarily firms and firm-related groups, expressed concern that the 2022 Proposal did not contain a provision about overcoming the presumption to confirm cash. A number of commenters also expressed the view that auditors could obtain direct-access view of bank information (or would be able to do so in the future), which could provide a more effective means of directly obtaining external evidence than sending a confirmation.

The Board agrees that if the auditor is able to perform other audit procedures that allow the auditor to obtain audit evidence by directly accessing information maintained by knowledgeable external sources, such audit evidence would be at least as persuasive as audit evidence obtained through confirmation procedures. The Board therefore added to the presumption to confirm cash (and accounts receivable) in the new standard the phrase “or otherwise obtain relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source.”

By way of example, the auditor might satisfy this requirement to obtain relevant and reliable audit evidence under the new standard by obtaining read-only access to information maintained by a financial institution concerning its transactions or balances with the company directly online through a secure website of the financial institution using credentials provided to the auditor by the financial institution.

The Term “Cash and Cash Equivalents Held by Third Parties”

The 2022 Proposal provided that the term “cash” comprised both cash and cash equivalents. Cash equivalents generally refer to short-term, highly liquid investments that are readily convertible to known amounts of cash and are so near their maturity that they present insignificant risk of changes in value because of changes in interest rates.^[55] Such assets are commonly used by companies to manage their cash holdings. The 2022 Proposal also described that the requirements for confirming cash would apply to cash held by third parties, and not limited to cash held by financial institutions. In the Board's view, this expansion of confirmation requirements was appropriate, as company funds can be held by third parties other than financial institutions, such as money transfer providers.

The Board adopted this provision as proposed in the 2022 Proposal.

There was one comment related to this aspect of the 2022 Proposal, suggesting that the new standard should specify that “third parties” are not limited to financial institutions. The Board believes the reference to “third parties” was sufficiently clear as proposed and, accordingly, has not expanded this description.

Confirming Other Financial Relationships

The 2022 Proposal provided that the auditor should consider confirming other financial relationships with the third parties with which the auditor determines to confirm cash. Such relationships can include lines of credit, other indebtedness, compensating balance arrangements, or contingent liabilities, including guarantees. As proposed, the auditor would be required under PCAOB standards to document the consideration given to the confirmation of other financial relationships and the conclusions reached.^[56] Existing AS 2310 does not have an analogous requirement to confirm other financial relationships.

The Board adopted this provision as proposed, with certain modifications discussed below.

Several commenters stated that the requirements for the auditor to consider confirming other financial relationships were clear. One commenter suggested that confirming other financial relationships should be required, and that overcoming the presumption to confirm should be available only when the financial entity with which the company does business does not offer services that would give rise to other financial relationships.

A number of commenters asserted that auditors would be required to produce additional documentation of their considerations, even when a financial relationship(s) is not an area of significant risk of material misstatement. Some commenters recommended that the provision that the auditor “should consider” other financial relationships be changed to “may consider,” in order to allow for more auditor judgment in determining the audit procedures to perform.

The Board continues to believe that information about financial relationships, including off-balance sheet relationships, could be important for the audit, as it could be part of significant disclosures in a company's financial statements. Accordingly, paragraph .29 of the new standard provides that, in addition to obtaining audit evidence from a knowledgeable external source regarding cash in accordance with paragraph .24, the auditor should consider sending confirmation requests to that source about other financial relationships with the company, based on the assessed risk of material misstatement. The phrase “based on the assessed risk of material misstatement” was added to clarify that the auditor has flexibility in tailoring audit procedures to the level of assessed risk ( e.g., by including or not including confirmation in the audit response based on the auditor's assessed risk of material misstatement of other financial relationships). In addition, paragraph .29 retains the examples of other financial relationships that were included in the 2022 Proposal.

Accounts Receivable

Confirming Accounts Receivable

The 2022 Proposal carried forward the requirement in existing AS 2310 to confirm accounts receivable. Similar to existing AS 2310, the 2022 Proposal did not specify the extent of confirmation procedures for accounts receivable. As noted above, the timing and extent of confirmation procedures are part of the auditor's response to the risks of material misstatement under PCAOB risk assessment standards. The 2022 Proposal instead required the auditor to take into account the auditor's understanding of the substance of the company's arrangements and transactions with third parties and the nature of the items that make up the company's account balances in selecting the individual accounts receivable to confirm. For example, an auditor might assess the risk of material misstatement relating to accounts receivable higher for a company that is being audited for the first time by the auditor, or for accounts receivable from a newly acquired operation in a foreign location.

The Board adopted the proposed requirements to confirm accounts receivable, with certain modifications discussed below.

Most commenters on this aspect of the 2022 Proposal generally supported the retention of a presumption to confirm accounts receivable, and most of those commenters stated that the requirement for the auditor to confirm accounts receivable was sufficiently clear and appropriate. Two investor-related groups stated that confirmation of cash and accounts receivable was necessary, in their view, to obtain persuasive, sufficient, and competent audit evidence.

On the other hand, a number of commenters, primarily firms and firm-related groups, expressed concerns about carrying forward the presumption for auditors to confirm accounts receivable from existing AS 2310. The common theme of those commenters was that requiring the auditor to use confirmation for certain accounts may not allow the auditor to exercise professional judgment in determining an appropriate response to the assessed risk of material misstatement for those accounts.

Regarding the selection of accounts receivable to confirm, several commenters agreed that the 2022 Proposal was sufficiently principles-based to allow auditors to use professional judgment in determining the extent of confirmation of accounts receivable.

The Board continues to believe that a presumption to confirm accounts receivable is appropriate to emphasize that audit evidence obtained from a knowledgeable external source is generally more reliable than evidence obtained only from internal company sources. Consistent with the objective of the new standard, the requirement to confirm cash and accounts receivable, or otherwise obtain relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source, only applies when the auditor has determined that these accounts are significant accounts.

As with cash balances discussed above, the Board believes that when the auditor is able to perform other audit procedures to obtain audit evidence about accounts receivable by directly accessing information maintained by knowledgeable external sources ( e.g., information maintained by the receivable counterparty), such evidence would be at least as persuasive as audit evidence through confirmation procedures. The Board therefore added to the presumption to confirm cash and accounts receivable in the new standard the phrase “or otherwise obtain relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source.”

Audit evidence that an auditor obtains by accessing a third party's information directly can be at least as persuasive as audit evidence obtained through confirmation procedures because the auditor is able to observe first-hand the information providing such evidence. As technology continues to develop, The Board believes it is important for the new standard to reflect that there may be additional opportunities for the auditor to obtain audit evidence directly beyond sending a confirmation request. The new standard would allow for future innovations in audit techniques that might involve the auditor obtaining evidence for accounts receivable by directly accessing information maintained by a counterparty or other knowledgeable external source. As noted in the new standard, consistent with selecting a confirming party, when selecting the knowledgeable external source providing the auditor with access to information directly, the auditor would be required to consider whether the knowledgeable external source would have any incentive or pressure to provide the auditor with access to information directly that is inaccurate or otherwise misleading.

Situations where it would not be feasible for the auditor to obtain audit evidence for accounts receivable directly from a knowledgeable external source, through confirmation procedures or other means, are discussed below.

The Term “Accounts Receivable”

The 2022 Proposal described “accounts receivable” as comprising receivables arising from the transfer of goods or services to a customer or from a financial institution's loans. Existing AS 2310 describes accounts receivable as the entity's claims against customers that have arisen from the sale of goods or services in the normal course of business, and a financial institution's loans. The 2022 Proposal was designed to apply to the same types of items as existing AS 2310, with a modified description to align more closely with the terminology of current accounting requirements, which have been updated since existing AS 2310 was written.^[57]

The Board adopted this provision as proposed.

Commenters on this aspect of the 2022 Proposal stated that the description of accounts receivable was clear. These commenters also noted that there was no need to further broaden the description to include additional types of receivables.

The description of accounts receivable in the new standard includes receivables that arise from the transfer of goods or services to a customer. These types of receivables generally arise from the company's ordinary revenue-generating activities, and include items for which revenue has been or will be recognized by a company, such as receivables from selling manufactured products or providing a service to customers. The description of accounts receivable also includes a financial institution's loans, including loans to customers that the institution has originated or purchased from another institution. Examples of financial institutions are banks, non-bank lenders, and mortgage companies that provide financing to customers.

Situations When Obtaining Audit Evidence for Accounts Receivable Directly Would Not Be Feasible

Performing Other Substantive Procedures, Including Tests of Details

In the 2022 Proposal, the presumption to confirm accounts receivable could be overcome when the auditor determined that an audit response that only included substantive audit procedures other than confirmation would provide audit evidence that is at least as persuasive as evidence the auditor might expect to obtain through performing confirmation procedures. The 2022 Proposal did not carry forward the provisions in existing AS 2310 addressing overcoming the presumption to confirm accounts receivable under certain conditions, which are (i) immateriality, (ii) ineffectiveness of confirmation, or (iii) a certain combination of the assessed risk and expected results from other auditing procedures.^[58]

As discussed below, the new standard includes a provision to address situations when obtaining audit evidence directly from knowledgeable external sources, whether through confirmation procedures or other means, would not be feasible to execute.

Many commenters addressed the provision in the 2022 Proposal to overcome the presumption to confirm accounts receivable. A few commenters noted that the ability to overcome the presumption to confirm accounts receivable was clear and appropriate. As discussed below, many commenters focused on the proposed provision that evidence obtained through other substantive procedures should be “at least as persuasive as” evidence obtained through confirmation:

• A number of investor-related groups stated that the provision gave too much leeway to auditors to overcome the presumption to confirm accounts receivable. These commenters asserted that exceptions to confirming accounts receivable should only be available when other audit procedures would provide more persuasive or greater accumulated evidence than that obtained through confirmation. These commenters recommended additional requirements, such as allowing the auditor to overcome the presumption only if they document the evidence and basis for their conclusion and have communicated the conclusion to the audit committee and investors.
• Several firms and firm-related groups stated that the relevant provisions were not clear or more guidance would be needed about overcoming the presumption to confirm accounts receivable when other substantive procedures would be “at least as persuasive as” the evidence expected to be obtained through confirmation. A few commenters observed that the absence of a definition of the term “persuasive” in AS 1105 contributed to a lack of clarity as to the Board's expectations and requested more guidance about how to measure or evaluate persuasiveness. Several commenters emphasized that, rather than focus the requirement for overcoming the presumption to confirm accounts receivable on whether audit evidence obtained through audit procedures other than confirmation is “at least as persuasive as” evidence expected to be obtained through confirmation, the Board should focus the requirement on obtaining evidence that is sufficient and appropriate to address the assessed risk of material misstatement or, as one commenter suggested, on the reliability of the audit evidence.
• Several commenters suggested that the Board retain provisions similar to those in existing AS 2310.34 for allowing the auditor to overcome the presumption to confirm accounts receivable. In addition, several firms and firm-related groups suggested that the auditor's ability to overcome the presumption to confirm should be based on risk assessment, similar to the provision in existing AS 2310 addressing when the assessed level of inherent and control risk is low.
• Many firms and firm-related groups expressed concern that the criteria for overcoming the presumption would result in auditors having to use confirmation even in situations where historically confirmations were determined by the auditor to be ineffective and not to provide persuasive audit evidence.
• One commenter stated that, if the proposed language were adopted, auditors would likely default to confirming accounts receivable over other audit procedures to avoid second-guessing of their determinations of the persuasiveness of audit evidence.
• Several commenters, primarily firms and firm-related groups, stated that the 2022 Proposal imposed a higher threshold than the existing standard for auditors to overcome the presumption to confirm accounts receivable without a corresponding increase to audit quality.

As previously discussed, the new standard creates a presumption that the auditor performs confirmation procedures or otherwise obtains relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source. Under PCAOB standards, in general, evidence obtained directly by the auditor from a knowledgeable external source is more reliable than evidence obtained indirectly.^[59] However, the Board appreciates that there are instances where the auditor determines that performing confirmation procedures in response to a risk of material misstatement related to accounts receivable would not be feasible. For example, commenters described situations involving a history of low response rates to confirmation requests in certain industries ( e.g., healthcare, utilities), or where customers have been advised by a government agency to avoid providing personal or financial information in response to an unexpected request. The Board further understands that companies in other industries ( e.g., large retailers, defense and aerospace companies that contract with the federal government) do not, as a matter of policy, respond to confirmation requests. There may also be instances in which the performance of confirmation procedures would not result in reliable audit evidence.

Accordingly, paragraph .25 allows the auditor to perform other substantive procedures in response to a risk of material misstatement, as long as such procedures include tests of details, if the auditor determines it is not feasible to obtain audit evidence directly from a knowledgeable external source pursuant to paragraph .24. Paragraph .25 specifically provides that the auditor's determination should be based on the auditor's experience, such as prior years' audit experience with the company or experience with similar engagements where the auditor did not receive confirmation responses, and the auditor's expectation of similar results if procedures were performed pursuant to paragraph .24. Any such determination would be performed as part of conducting the audit based on the available facts and circumstances at that time and properly supported in the audit documentation for the engagement.^[60] In addition, as described below, for significant risks associated with accounts receivable, the auditor would be required to communicate with the audit committee when the auditor did not perform confirmation procedures or otherwise obtain audit evidence by directly accessing information maintained by a knowledgeable external source.

This provision replaces the concept in the 2022 Proposal about obtaining audit evidence that was “at least as persuasive as” the evidence expected to be obtained through confirmation procedures. It also specifies that the auditor should perform other substantive procedures, including tests of details, in these situations to make clear that performing only substantive analytical procedures would not be sufficient to overcome the presumption to confirm. These other substantive procedures should involve obtaining external information indirectly.

For accounts receivable, the auditor may be able to satisfy this requirement by obtaining information that is in the company's possession that the company received from one or more knowledgeable external sources.^[61] Examples of such external information may include, for example, subsequent cash receipts, shipping documents from third-party carriers, customer purchase orders, or signed contracts and amendments thereto. This information may be in electronic form ( e.g., a purchase order initiated by a customer through a company's website) or in paper form ( e.g., a signed contract).

Conversely, when performing other substantive procedures under this provision, it would not satisfy the requirements of the new standard to use or rely solely on the company's internally produced information. For example, an audit procedure that involves an automated matching analysis of a company's revenue, accounts receivable, and cash journal entries recorded by the company would be insufficient on its own because such an analysis only involves the company's internally produced information. On the other hand, when such internally produced information is evaluated in conjunction with external information that the company received from a knowledgeable external source, such as checks that the company received directly from customers or information on subsequent cash receipts that the company received from a financial institution, the procedures would involve audit evidence from a knowledgeable external source.

Under existing PCAOB standards, the quantity of audit evidence needed is affected by its quality, including its reliability, and in general evidence obtained directly by the auditor is more reliable than evidence obtained indirectly. This applies to all information (including external information) used by the auditor in arriving at the conclusions on which the auditor's opinion is based. For example, as the quality of the evidence increases, the need for additional corroborating evidence decreases. The auditor should be mindful of these requirements when determining an appropriate audit response to a risk of material misstatement that involves obtaining external information indirectly under the new standard.

Further, when performing audit procedures that involve obtaining external information, the auditor should be mindful of other relevant PCAOB standards that address the documentation of the procedures performed and the relevance and reliability of the audit evidence obtained.^[62] Audit documentation must clearly demonstrate the work performed by the auditor. In addition, the reliability of that audit evidence depends on the nature and source of the evidence and the circumstances under which it is obtained.

Communicating With the Audit Committee About the Auditor's Response to Significant Risks for Cash and Accounts Receivable

The 2022 Proposal included a requirement for the auditor to communicate to the audit committee ^[63] instances where the auditor had determined that the presumption to confirm accounts receivable had been overcome. In proposing that requirement, the Board considered the long-standing practice by auditors in the United States to confirm accounts receivable, and noted that a communication requirement when the presumption to confirm is overcome could enhance the audit committee's understanding of the auditor's strategy. In this regard, existing standards require the auditor to communicate to the audit committee about the auditor's overall audit strategy, significant risks identified during risk assessment procedures, significant changes to the planned audit strategy, and significant difficulties encountered during the audit.^[64] Existing AS 2310 does not have a requirement to communicate to the audit committee about overcoming the presumption to confirm accounts receivable.

The new standard contains a requirement for the auditor to communicate with the audit committee about the auditor's response to significant risks associated with cash or accounts receivable when the auditor did not perform confirmation procedures or otherwise obtain audit evidence by directly accessing information maintained by a knowledgeable external source.

Several commenters, primarily investor-related groups, supported the proposed requirement in the 2022 Proposal that the auditor communicate to the audit committee when an auditor overcomes the presumption to confirm accounts receivable. One of the commenters referred to a statement in the 2022 Proposal that a requirement to communicate to the audit committee when overcoming the presumption to confirm accounts receivable “may reinforce the auditor's obligation to exercise due professional care in making that determination.” This commenter also noted that overcoming the presumption could result in a critical audit matter under AS 3101, The Auditor's Report on an Audit of Financial Statements When the Auditor Expresses an Unqualified Opinion. ^[65]

Many commenters on this aspect of the 2022 Proposal, primarily firms and firm-related groups, disagreed with a specific requirement to communicate with the audit committee on this matter. These commenters asserted that such a requirement did not align with principles in AS 1301 to communicate with the audit committee about significant risks, including audit matters arising from the audit that are significant to the oversight of the company's financial reporting process. A number of these commenters also noted that, if there were a significant risk in accounts receivable or associated with a critical audit matter, the auditor would already be required to communicate these matters under AS 1301. Several other commenters indicated that they did not object to a more targeted requirement to communicate with the audit committee about overcoming the presumption to confirm when accounts receivable was assessed as a significant risk.

In addition, several commenters asserted that a requirement to communicate to the audit committee about overcoming the presumption to confirm would not improve audit quality, and could be detrimental if this communication became a compliance exercise for auditors, detracting them from performing effective audit procedures. A few commenters also stated there would not be a benefit to audit quality if the Board were to mandate that auditors treat instances of overcoming the presumption to confirm as a critical audit matter.

The 2022 Proposal stated that there may be some expectation by audit committees that the auditor would use confirmation as part of a planned audit response. One commenter encouraged the Board to perform outreach with audit committees to understand whether this expectation was, in fact, widespread and whether the proposed communication requirement would be relevant and meaningful.

Having considered the comments received, the Board does not believe it is necessary to require the auditor to inform the audit committee in every instance where the auditor performed substantive audit procedures other than confirmation to address the risk of material misstatement of cash or accounts receivable. However, the Board believes the auditor should inform the audit committee when the auditor did not perform confirmation procedures or otherwise obtain audit evidence by directly accessing information maintained by a knowledgeable external source when responding to significant risks associated with either cash or accounts receivable.

This targeted requirement is consistent with the views expressed by several commenters, as discussed above. It is also consistent with the existing obligation of auditors under PCAOB standards to communicate to the audit committee an overview of the overall audit strategy and to discuss with the audit committee the significant risks of material misstatement identified during the auditor's risk assessment procedures.^[66] In addition, as with other matters arising from the audit of financial statements and communicated or required to be communicated to the audit committee, the auditor is required to determine whether these matters are critical audit matters in accordance with AS 3101.^[67]

Confirming Terms of Certain Transactions

The 2022 Proposal provided that, for significant risks of material misstatement associated with either a complex transaction or a significant unusual transaction, the auditor should consider confirming terms of the transaction with the counterparty to the transaction. This provision updates a requirement in existing AS 2310.08 that the auditor should consider confirming the terms of certain transactions that are associated with high levels of risk. The 2022 Proposal used the terminology “significant risk” and “significant unusual transactions,” but the provision was intended to be similar to that in existing AS 2310.

The Board adopted the proposed requirements to consider confirming terms of certain transactions, with certain modifications discussed below.

Several commenters noted that the provision in the 2022 Proposal was sufficiently clear and appropriate. Other commenters suggested various modifications to the provision that they asserted would improve its clarity, such as elaborating on the meaning of the term “complex transaction” and stating that the provision applies when the assertions related to the significant risk of material misstatement can be adequately addressed through confirmation. Several commenters indicated that other audit procedures, not including confirmation, may adequately address an assessed significant risk over the existence assertion, such as obtaining and reviewing an original executed contract and verifying the execution of its terms over a period of time.

To provide additional clarity, the new standard provides that the auditor should consider confirming those terms of a complex transaction or significant unusual transaction that are associated with a significant risk of material misstatement, including a fraud risk. Under the new standard, examples of such terms may include terms relating to (i) oral side agreements, or undisclosed written or oral side agreements, where the auditor has reason to believe that such agreements exist, (ii) bill and hold sales, and (iii) supplier discounts or concessions. When such arrangements or agreements are part of a complex transaction or significant unusual transaction identified by the auditor, there may be a heightened risk that the transaction has been entered into to engage in fraudulent financial reporting or conceal misappropriation of assets. Likewise, a complex transaction or a significant unusual transaction could have a heightened risk of error whereby confirmation could lead to identification of an additional term that, under an accounting standard, might have accounting implications not previously recognized by either the company or the auditor. Accordingly, the auditor's confirmation of terms related to such arrangements or agreements may assist the auditor in evaluating the business purpose, or lack thereof, of the transaction.^[68] These examples are not intended to be an exhaustive list. An auditor may identify other terms to confirm relating to a complex transaction or a significant unusual transaction if the auditor decides that confirmation could result in obtaining relevant and reliable audit evidence about that transaction.

One investor-related group recommended that the provision in the 2022 Proposal addressing the terms of complex transactions and significant unusual transactions should be mandatory and read “should” instead of “should consider.” In contrast, other commenters asserted that the provision was unduly prescriptive. Several commenters recommended that the Board change the phrase “should consider” to “may consider” to allow for more auditor judgment in determining the audit procedures to perform to address significant unusual transactions or other complex transactions. The Board believes that the provision stating that the auditor “should consider” confirming terms of complex transactions or significant unusual transactions associated with a significant risk of material misstatement is sufficiently risk-based for the auditor to have flexibility in selecting the audit procedures that are best suited to address significant risks of material misstatement, depending on the facts and circumstances of individual transactions.

Another commenter suggested that the Board place additional emphasis on the auditor having a heightened degree of professional skepticism, similar to a provision in existing AS 2310.27, and that doing so would allow auditors to make appropriate judgments in determining whether facts and circumstances indicate that confirmation procedures may not produce sufficient appropriate evidence to address the assessed risks. The Board did not include additional language in the new standard about the auditor's potential need to exercise a heightened degree of professional skepticism related to confirmation because the auditor's obligation to apply professional skepticism is relevant to all aspects of the audit.^[69]

Performing Alternative Procedures for Selected Items

(See paragraphs .C1–.C2 of the new standard).

The 2022 Proposal provided that the auditor should perform alternative procedures in certain scenarios involving identifying confirming parties or evaluating the reliability of confirmation responses, as well as in scenarios involving nonresponses and incomplete responses.^[70] This range of scenarios was broader than under existing AS 2310, which provides that, with certain exceptions, the auditor should apply alternative procedures where the auditor has not received replies to positive confirmation requests. In addition, existing AS 2310 provides examples of alternative procedures, and requires the auditor to evaluate the combined evidence provided by confirmation and any alternative procedures and send additional confirmation requests or perform other audit tests, as needed, to obtain sufficient appropriate audit evidence.

The 2022 Proposal provided examples of alternative procedures that may provide relevant and reliable audit evidence regarding accounts receivable, accounts payable, and the terms of a transaction or agreement. These provisions expanded upon the examples of alternative procedures discussed in existing AS 2310.

The 2022 Proposal did not specify whether performing alternative procedures for the items the auditor was unable to confirm, alone or in combination with other audit procedures, is necessary to obtain sufficient appropriate audit evidence. Under the 2022 Proposal, the auditor would make that determination based on the facts and circumstances of the audit. Further, an auditor might determine that, without obtaining a reliable confirmation response, the auditor is unable to obtain sufficient appropriate audit evidence for a relevant assertion through performing alternative procedures for the items the auditor could not confirm, other audit procedures, or both ( e.g., if the auditor observes conditions during the confirmation process that indicate a heightened fraud risk). In such scenarios, the 2022 Proposal provided that the auditor would consider the impact on the audit opinion in accordance with AS 3105.

The 2022 Proposal also provided that performing alternative procedures may not be necessary where items selected for confirmation for which the auditor was not able to complete audit procedures would not—if misstated—change the outcome of the auditor's evaluation of the effect of uncorrected misstatements performed in accordance with AS 2810.17.^[71] For example, following the direction in AS 2810.17, under the 2022 Proposal an auditor may have determined that an item that the auditor was unable to confirm would not be material individually or in combination with other misstatements. In such situations, the auditor would not have been required to perform alternative procedures.^[72] Existing AS 2310 includes an analogous exception.

The Board adopted the requirements substantially as proposed, with certain modifications discussed below.

In the 2022 Proposal, the additional discussion of alternative procedures appeared in the main body of the proposed standard (paragraph .31). To enhance the readability of these provisions and facilitate their implementation, the Board has relocated them to Appendix C, which includes one paragraph that describes when performing other audit procedures may be necessary (paragraph .C1) and a second paragraph that provides further direction as to when alternative procedures are required under the new standard and includes examples of alternative procedures (paragraph .C2).

In addition, to remind auditors that the auditor's assessment of risks of material misstatement, including fraud risks, should continue throughout the audit, including the confirmation process, paragraph .C1 of the new standard states that, when the auditor is unable to obtain relevant and reliable audit evidence about the selected item through confirmation, the auditor should evaluate the implications for the auditor's assessment of the relevant risks of material misstatement, including fraud risks.

Several commenters indicated that the circumstances in the 2022 Proposal under which the auditor generally would be required to perform alternative procedures were sufficiently clear and appropriate. However, multiple commenters suggested that the Board include an example of an alternative procedure for cash. In consideration of these comments, the Board has incorporated an example of an alternative procedure that may provide relevant and reliable audit evidence regarding cash, which involves the auditor verifying information about the company's cash account maintained in a financial institution's information system by viewing this information directly on a secure website of the financial institution. In this example, the auditor might verify such information by determining the validity of the financial institution's website and viewing the information directly on the secure website. The information viewed by the auditor could be accessed either by the auditor, using login credentials provided by the company, or by company personnel. This additional example is intended to address some commenters' misperception that the 2022 Proposal would not allow the auditor to perform alternative procedures in the event that a positive confirmation request related to cash does not result in a confirmation response.

Several commenters asserted that the note in the 2022 Proposal identifying situations where alternative procedures may not be necessary was not clear, with one commenter indicating that the analogous exception in existing AS 2310 was clearer because it addressed audit sampling. In consideration of these comments, the Board has revised the note to paragraph .C2 of the new standard to clarify how the exception from performing alternative procedures for selected items should be applied and revised the footnote in the paragraph to further explain how the exception is applied in scenarios involving audit sampling.

The following example further illustrates applying this provision in an audit: An auditor selects a sample of 50 accounts receivable invoices for confirmation and receives confirmation responses for 45 invoices that do not indicate a need for the auditor to perform alternative procedures. For two nonresponses, the auditor performs alternative procedures and obtains relevant and reliable audit evidence identifying no misstatements. For the three remaining nonresponses, the auditor does not perform alternative procedures because the auditor appropriately determines that, even if the amounts associated with the invoices were projected as 100 percent misstatements to the population from which the sample was selected and added to any other accounts receivable misstatements ( i.e., accounts receivable misstatements identified through audit procedures other than confirmation), the outcome of the auditor's evaluation performed in accordance with AS 2810.17 would not change.

Another commenter recommended that, for nonresponses, the Board require that the auditor “must” perform alternative procedures that include examining third-party evidence. This commenter also suggested that the Board revise the example of alternative procedures for accounts receivable by removing the phrase “one or more,” such that the auditor would perform all of the procedures identified in the example ( i.e., examining subsequent cash receipts, shipping documents, and other supporting documentation).

Having considered these comments, the Board believes that, with the modifications discussed above, the requirements in paragraph .C1 of the new standard provide appropriate direction regarding when alternative procedures are required. Additionally, the Board believes that including examples in paragraph .C2 of alternative procedures that may provide relevant and reliable audit evidence about selected items, without mandating specific procedures, is appropriate, as it is impracticable to describe specific procedures for all scenarios that could occur in an audit.

Additionally, as discussed above, the Board has modified paragraph .B2 of the new standard to provide that in circumstances where the auditor should not use an intermediary to send confirmation requests or receive confirmation responses, the auditor should send confirmation requests without the use of an intermediary or, if unable to do so, perform alternative procedures in accordance with Appendix C of the new standard. In light of this modification, the Board has added a reference to paragraph .B2 to Appendix C of the new standard.

Evaluating Results

(See paragraph .31 of the new standard).

The 2022 Proposal did not carry forward a requirement, included in existing AS 2310, for the auditor to evaluate in the aggregate audit evidence obtained from performing confirmation procedures and any alternative procedures. Excluding this requirement from the 2022 Proposal was intended to avoid the duplication of certain requirements of AS 2810 that discuss the auditor's responsibilities for evaluating audit results and determining whether the auditor has obtained sufficient appropriate audit evidence.

As discussed above, however, paragraph .24 of the new standard allows the auditor to perform audit procedures other than confirmation for cash and accounts receivable to obtain relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source. The Board therefore decided to remind the auditor in paragraph .31 of the new standard that the auditor should evaluate the combined audit evidence provided by confirmation procedures, alternative procedures, and other procedures to determine whether sufficient appropriate audit evidence has been obtained in accordance with AS 2810.

Other Matters

This section addresses certain additional matters that were also discussed in the 2022 Proposal. In addition, this section discusses definitions included in the new standard and related amendments to PCAOB auditing standards.

Management Requests Not To Confirm

Consistent with existing AS 2310, the 2022 Proposal did not address, nor does the new standard address, situations in which management requests that the auditor not confirm one or more items.

Several commenters agreed with the approach in the 2022 Proposal and indicated that auditor responsibilities in such situations are already addressed by existing PCAOB standards. One commenter suggested that the Board consider adding a requirement that, if management requests an auditor not to confirm a certain item, the auditor should both request management to indicate the reason for the request and, as appropriate, consider whether the request is indicative of a risk of material misstatement. Another commenter agreed that the potential scope limitation or fraud risk from a management request not to confirm is addressed in other PCAOB standards, but expressed the view that including guidance in the new standard unique to confirmation would be appropriate. A different commenter did not suggest changes to the Board's approach, but observed that management requests not to confirm are primarily relevant in the financial services industry and that it had experienced infrequent management requests not to confirm in other industries.

Having considered the comments received, the Board believes that existing PCAOB standards appropriately address situations involving management requests not to confirm. In particular, AS 1301 requires that the auditor communicate to the audit committee disagreements with management ^[73] and difficulties encountered in performing the audit, including unreasonable management restrictions encountered by the auditor on the conduct of the audit ( e.g., an unreasonable restriction on confirming transactions or balances).^[74] AS 3105 also sets forth requirements regarding limitations on the scope of an audit,^[75] including scope limitations relating to confirmation.^[76]

Further, AS 2110 and AS 2401 describe the auditor's responsibilities regarding identifying, assessing, and responding to fraud risks. For example, AS 2401.09 states that fraud may be concealed by withholding evidence. A management request to limit audit testing by not obtaining external audit evidence through confirmation could be relevant to the auditor's consideration of fraud risk factors, including the consideration of management incentives, opportunities, and rationalization for perpetrating fraud. Considering the applicability of existing provisions to situations involving management requests not to confirm, as discussed above, the Board believes that including analogous requirements in the new standard could lead to unnecessary duplication of existing requirements and potential confusion.

Restrictions and Disclaimers

The requirements in the proposed standard relating to the auditor's evaluation of the reliability of confirmation responses included a reminder, in the form of a footnote, of the auditor's responsibilities under AS 1105 as they relate to restrictions and disclaimers. A similar reminder does not exist in existing AS 2310.

The Board is including this reference to AS 1105.08 as proposed, in a footnote to paragraph .18 of the new standard. No comments were received on this aspect of the 2022 Proposal. In accordance with AS 1105.08, the auditor should evaluate the effect of restrictions, limitations, or disclaimers in confirmation responses on the reliability of audit evidence.^[77]

Direct Access

The 2022 Proposal did not describe direct access as a confirmation procedure. Existing AS 2310 currently does not address such a procedure, but the 2010 Proposal had provided that direct access could be considered a confirmation procedure in certain circumstances.

A few commenters on the 2022 Proposal either agreed with, or indicated that they did not object to, the Board's stated position that direct access does not constitute a confirmation procedure. However, several firms and firm-related groups stated that, when properly executed, audit evidence obtained by the auditor through direct access can provide persuasive evidence about the existence of cash. One commenter recommended that the PCAOB consider aligning with the AICPA's position on this matter by acknowledging that the auditor's direct access to information held by a confirming party may meet the definition of a confirmation procedure when, for example, the confirming party provides the auditor with the electronic access codes or other information necessary to access a secure website where data that addresses the subject matter of the confirmation is held.

Having considered these comments, the Board adopted the new standard as proposed in relation to direct access.

While direct access does not constitute a confirmation procedure under the new standard, the new standard provides that the auditor may obtain relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source, as discussed above.

Definitions

To operationalize the requirements included in the 2022 Proposal, the proposal included definitions for “confirmation exception,” “confirmation process,” “confirmation request,” “confirmation response,” “confirming party,” “negative confirmation request,” “nonresponse,” and “positive confirmation request.”

The Board adopted the definitions as proposed, with certain modifications discussed below.

Several commenters stated that, in general, the definitions in the 2022 Proposal were sufficiently clear and appropriate. Other commenters either did not provide comments on the proposed definitions or suggested certain modifications, as discussed below.

Some commenters stated that the Board should modify the proposed definition of “nonresponse” to reflect that a nonresponse includes a situation where the auditor does not receive a confirmation response to a positive confirmation request directly from the intended confirming party. Having considered this comment, the Board is aligning the definition of “nonresponse” with the definition of “confirmation response” and the requirements of paragraph .16 of the new standard. This modification clarifies that a confirmation response that is not received directly from the confirming party would constitute a nonresponse. The Board has also modified the definition of “negative confirmation request” to use the defined term “confirmation request” rather than “request.”

One commenter proposed modifications to the definitions of “confirmation exception” and “confirmation process” to specify that (i) sending a confirmation request may include transmitting the request in electronic form and (ii) only differences between a confirmation response and information the auditor obtained from the company that the auditor had originally sought to confirm constitute a confirmation exception. Having considered the comment, the Board notes that the proposed definition of “confirmation process” intentionally did not prescribe the method or methods by which confirmation requests can be sent and by which confirmation responses can be received, as the standard is intended to apply to all methods of sending and receiving confirmation requests and responses. Further, the Board believes that any instance where information in a confirmation response differs from information the auditor obtained from the company, even if the information in the confirmation response was not information that the auditor originally sought to confirm, should constitute a confirmation exception. Accordingly, the Board adopted the definition of “confirmation exception” as proposed and adopted the definition of “confirmation process” as proposed, with one modification to include “selecting one or more items to be confirmed” in the definition to align with the requirements specifically related to the confirmation process in the new standard.

The 2022 Proposal also indicated that an oral response to a confirmation request was a nonresponse. One commenter stated that a video recording of a call between an auditor and an individual at a confirming party ought not be considered less reliable audit evidence than a written response from an organization. Another commenter suggested that the PCAOB define the term “confirmation” because the 2022 Proposal stated that an oral response was a nonresponse but did not provide guidance as to whether other forms of response would be evidence of confirmation.

As the Board continues to believe that obtaining direct written communication, in paper or electronic form, from a confirming party is necessary for a response to constitute a confirmation response, the Board has not made further modifications to the definition in the new standard beyond those described above. Accordingly, a video recording of a call between an auditor and an individual at a confirming party or an oral response would constitute nonresponses under the new standard, although the auditor could still consider the relevance and reliability of the audit evidence provided by a video recording or an oral response when determining the nature and extent of alternative procedures required to be performed under the new standard.

Amendments to Related PCAOB Auditing Standards

The Board adopted amendments to several existing PCAOB auditing standards to align with the new standard.

Amendments to AS 1105

(See paragraph .18 of AS 1105, as amended).

The 2022 Proposal included proposed amendments to AS 1105 to (i) align the description of a “confirmation response” in AS 1105 with the definition of the same term included in the 2022 Proposal and (ii) clarify that the terms “confirmation response,” “confirmation request,” and “confirming party,” as used in AS 1105, have the same meaning as defined in Appendix A of the 2022 Proposal.

The Board adopted the amendments as proposed.

Existing AS 1105.18 states that “[a] confirmation response represents a particular form of audit evidence obtained by the auditor from a third party in accordance with PCAOB standards.” The 2022 Proposal used the defined term “confirming party” in lieu of “third party.” One commenter suggested retaining the phrase “third party” in AS 1105.18 to provide further clarity. The Board is not using this term because the new standard describes a confirming party as “a third party, whether an individual or an organization, to which the auditor sends a confirmation request,” thus making it clear that a confirming party is a third party.

Another commenter suggested that the Board strike the word “independent” from AS 1105.08, which states that “[e]vidence obtained from a knowledgeable source that is independent of the company is more reliable than evidence obtained only from internal company sources.” This commenter asserted that, although confirmation evidence may be more reliable, it is not truly “independent.” The Board is not striking the word “independent” from AS 1105.08 as it believes the concept expressed in AS 1105.08 is well understood by auditors and does not purport to be a definitive statement about the “independence” of evidence from a confirming party.

Amendments to AS 1301

(See Appendix B to AS 1301, as amended).

The 2022 Proposal included a proposed requirement for the auditor to communicate to the audit committee instances in which the auditor has determined that the presumption to confirm accounts receivable has been overcome and the basis for the auditor's determination. The 2022 Proposal included a conforming amendment to AS 1301 that would refer to the proposed requirement.

The Board adopted the conforming amendment to AS 1301 that refers to the audit committee communication requirement contained in the new standard. The required communication with the audit committee about the auditor's response to significant risks associated with cash or accounts receivable when the auditor did not perform confirmation procedures or otherwise obtain audit evidence by directly accessing information maintained by a knowledgeable external source is discussed above.

Amendments to AS 2401

(See paragraphs .54 and .66A of AS 2401, as amended).

The 2022 Proposal included a proposed amendment to AS 2401 to refer to the title of the confirmation standard as proposed in the 2022 Proposal ( i.e., “The Auditor's Use of Confirmation”).

The Board adopted the amendment as proposed and adopted an additional conforming amendment to AS 2401, as discussed below.

One commenter suggested that the Board consider a conforming amendment to AS 2401 to acknowledge a requirement in proposed paragraph .15 to consider confirming terms of the transaction for significant risks of material misstatement associated with either a complex transaction or significant unusual transaction. Having considered the comment, the Board adopted a conforming amendment to the note to AS 2401.66A to remind the auditor of the requirement in paragraph .30 of the new standard that for significant risks of material misstatement associated with either a complex transaction or a significant unusual transaction, the auditor should consider confirming those terms of the transaction that are associated with a significant risk of material misstatement, including a fraud risk.

Amendments to AS 2510

(See paragraph .14 of AS 2510, as amended).

AS 2510.14 includes a statement that “if inventories are in the hands of public warehouses or other outside custodians, the auditor ordinarily would obtain direct confirmation in writing from the custodian.” The 2022 Proposal included a proposed amendment to AS 2510 to remind auditors that AS 2310 establishes requirements for the auditor's use of confirmation.

The Board adopted the amendment as proposed.

One commenter stated that the Board should address the confirmation of inventory in the new standard instead of making conforming amendments to AS 2510. The Board continues to believe that including requirements related to inventory in a single standard is appropriate. However, the Board acknowledges that AS 2510.14 includes two requirements related to the confirmation of inventory. First, AS 2510.14 provides that “[i]f inventories are in the hands of public warehouses or other outside custodians, the auditor ordinarily would obtain direct confirmation in writing from the custodian.” Second, AS 2510.14 further states that the auditor should perform one or more of four additional procedures, as considered necessary by the auditor, if such inventories represent a significant proportion of current or total assets. One such procedure is to confirm pertinent details of pledged receipts with lenders (on a test basis, if appropriate), if warehouse receipts have been pledged as collateral. The Board has added a cross-reference to AS 2510 in footnote 4 of the new standard to clarify that AS 2510 also includes auditor responsibilities relevant to the auditor's use of confirmation.

Amendments to AS 2605

(See paragraphs .22 and .27 of AS 2605, as amended).

AS 2605.22 includes a statement that “for certain assertions related to less material financial statement amounts where the risk of material misstatement or the degree of subjectivity in the valuation of the audit evidence is low, the auditor may decide, after considering the circumstances and the results of work (either test of controls or substantive tests) performed by internal auditors on those particular assertions, the audit risk has been reduced to an acceptable level and that testing of the assertions directly by the auditor may not be necessary.” The paragraph then includes assertions about the existence of cash, prepaid assets, and fixed-asset additions as examples of assertions that might have a low risk of material misstatement or involve a low degree of subjectivity in the evaluation of audit evidence.

The 2022 Proposal included a proposed amendment to strike the word “cash” from AS 2605.22 to avoid confusion, as the 2022 Proposal required the auditor to perform confirmation procedures in respect of cash.

In addition, the 2022 Proposal included a proposed amendment to acknowledge in paragraph .27 of AS 2605, which discusses using internal auditors to provide direct assistance to the auditor, the proposed restrictions on the use of internal audit in a direct assistance capacity in the confirmation process.

The Board adopted the amendments substantially as proposed, with certain modifications discussed below.

One commenter indicated that the proposed amendment to AS 2605.22 ( i.e., striking the word “cash” from the list of accounts that might have a low risk of material misstatement), inappropriately assumed that there is always a heightened risk of fraud related to cash accounts in all audit engagements. Having considered the comment, the Board notes that neither the 2022 Proposal nor the new standard suggests that there is heightened risk of fraud associated with cash in every engagement. However, the Board believes that where an auditor identifies a risk of material misstatement for cash ( i.e., where cash is a significant account) it is necessary for the auditor to perform confirmation procedures or otherwise obtain relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source in respect of cash. Accordingly, the Board continues to believe that the conforming amendment to AS 2605.22 is appropriate.

Another commenter indicated that the proposed amendment to AS 2605.27 would not be necessary should the Board adopt the commenter's other recommendation to remove the proposed restrictions regarding the use of internal audit in the new standard. As discussed above, the Board continues to believe that in order to maintain control over the confirmation process the auditor should select items to be confirmed, send confirmation requests, and receive confirmation responses. The Board modified the conforming amendments to AS 2605.27, however, to align with paragraph .15 of the new standard.

Effective Date

The Board determined that the amendments will take effect, subject to approval by the SEC, for audits of financial statements for fiscal years ending on or after June 15, 2025.

As part of the 2022 Proposal, the Board sought comment on the amount of time auditors would need before the proposed standard and related amendments would become effective, if adopted by the Board and approved by the SEC. Many commenters, primarily firms and firm-related groups, supported an effective date of no earlier than two years after SEC approval, which some commenters indicated would give firms the necessary time to update firm methodologies and to develop and implement training. Additionally, as part of recommending an effective date no earlier than two years after SEC approval, a number of commenters observed that confirmation procedures are often performed as part of interim procedures and that, as a result, the new standard will impact engagement teams during the period under audit. Some commenters also stated that intermediaries involved in the confirmation process may also need to update their processes and controls as a result of the new standard. One commenter supported an effective date three years after SEC approval, while citing reasons similar to those expressed by commenters who supported an effective date of no earlier than two years after SEC approval.

The Board recognizes the preferences expressed by commenters. Nonetheless, having considered the requirements of the new standard, as well as the extent of differences between the new standard and AS 2310 and our understanding of firms' current practices, the Board believes that the effective date for fiscal years ending on or after June 15, 2025, will provide auditors with a reasonable period of time to implement the new standard and related amendments, without unduly delaying the intended benefits resulting from these improvements to PCAOB standards, and is consistent with the Board's mission to protect investors and protect the public interest.

D. Economic Considerations and Application to Audits of Emerging Growth Companies

The Board is mindful of the economic impacts of its standard setting. This section describes the economic baseline, need, and expected economic impacts of the new standard, as well as alternative approaches considered by the Board. Because there are limited data and research findings available to estimate quantitatively the economic impacts of the new standard, the economic analysis is largely qualitative in nature.

Baseline

Important components of the baseline against which the economic impact of the new standard can be considered are described above, including the Board's existing standard governing the audit confirmation process, firms' current practices when performing confirmation procedures, and observations from the Board's inspections program and enforcement cases. The Board discusses below two additional components that inform its understanding of the economic baseline: (i) the PCAOB staff's analysis of audit firm methodologies and the use of technology-based tools in the confirmation process, and (ii) a summary of academic and other literature on the confirmation process.

Auditing Practices Related to the Confirmation Process

Through its inspection and other oversight activities, the PCAOB has access to sources of information that help inform its understanding of how firms currently engage in the confirmation process. As part of this standard-setting project, the PCAOB staff has reviewed a selection of firms' audit methodologies, as well as other information about firms' use of technology-based tools when performing confirmation procedures. While this information is not a random sample that can be extrapolated accurately across all registered public accounting firms, the Board is able to make some general inferences that help inform development of the economic baseline.

PCAOB Staff Analysis of Audit Methodologies

PCAOB staff has reviewed the methodologies of selected registered public accounting firms to determine how they currently address the confirmation process and the extent to which changes to those methodologies will be necessary to implement the new standard. Specifically, the staff compared methodologies of selected global network firms (“GNFs”) ^[78] and some methodologies commonly used by U.S. non-affiliate firms (“NAFs”),^[79] which are smaller than GNFs, to existing AS 2310 as well as to the new standard. The review focused on the following aspects of the new standard which represent more notable changes relative to existing AS 2310:

• Substantive procedures for confirming cash and cash equivalents (paragraphs .24, .26, and .29);

• Substantive procedures for confirming accounts receivable (paragraphs .24–.25 and .27);
• The auditor's use of negative confirmation requests (paragraphs .12–.13);
• Maintaining control over the confirmation process, including when an intermediary is used (paragraphs .14–.17 and .Appendix B); and
• Other areas addressed in the new standard, including the evaluation of the reliability of confirmation responses (paragraphs .18–.19), and the performance of alternative procedures (Appendix C).

For the GNF methodologies reviewed, PCAOB staff observed that the methodologies generally reflect requirements in existing AS 2310 and other auditing standards on external confirmation, such as ISA 505 and AU–C 505. In addition, some of the methodologies already incorporate certain concepts included in the new standard, although revisions to the methodologies will nonetheless be needed to implement the new standard.

Specifically, some GNF methodologies, but not all, include requirements for confirmation of cash and cash equivalents held by third parties similar to the new requirements described in the new standard. Other GNF methodologies suggest, but do not require, that engagement teams consider specific confirmation procedures for cash and cash equivalents held by third parties. GNF methodologies for confirmation of accounts receivable are generally consistent with existing AS 2310. Some also include guidance that is similar in certain respects to the requirements in the new standard when the auditor is unable to obtain relevant and reliable audit evidence through confirmation procedures. With respect to negative confirmation requests, GNF methodologies acknowledge that negative confirmation requests provide less persuasive evidence than positive confirmation requests. However, some GNF methodologies still allow the use of negative confirmation requests as the sole substantive procedure under certain conditions.^[80]

The PCAOB staff also observed that GNF methodologies generally include guidance on maintaining control over the confirmation process, using intermediaries to facilitate the electronic transmission of confirmation requests, and assessing controls at the intermediaries. The firms' guidance in this area focuses on the performance of audit procedures to ensure that the electronic confirmation process occurs in a secure and controlled environment and that confirmation responses received are reliable. For example, the methodologies of some firms provide that an auditor may obtain a SOC report that would assist the engagement team in assessing the design and operating effectiveness of the intermediary's controls that address the risk of interception and alteration of confirmation requests and responses. Finally, although current GNF methodologies include guidance on the other areas being modernized or clarified in the new standard, GNFs may be required to make certain modifications to their methodologies to conform to the new standard, such as whether to perform alternative procedures.

For the NAF methodologies reviewed, the PCAOB staff observed that the methodologies generally align with existing AS 2310 across each of the areas studied, but include some guidance related to the new requirements in the new standard. For example, in some of the NAF methodologies, the confirmation of cash and cash equivalents held by third parties is a consideration but not a requirement. In other NAF methodologies, the confirmation of cash and cash equivalents held by third parties and negative confirmation requests are not discussed at all. NAF methodologies for confirmation of accounts receivable are generally consistent with existing AS 2310. Some include guidance that is similar in certain respects to the requirements described in the new standard when the auditor is unable to obtain relevant and reliable audit evidence through confirmation procedures.

The NAF methodologies also generally include guidance on maintaining control, using intermediaries in the confirmation process, and assessing controls at the intermediaries. Similar to GNF methodologies, NAF guidance in this area focuses on the performance of audit procedures to ensure that the electronic confirmation process occurs in a secure and controlled environment and that confirmation responses received are reliable. For example, a firm's methodology may provide that an auditor may obtain a SOC report that would assist the engagement team in assessing the design and operating effectiveness of the intermediary's controls that address the risk of interception and alteration of confirmation requests and responses.

Commenters on the 2022 Proposal did not provide additional information on firm methodologies beyond the staff's analysis. In general, the PCAOB staff's review indicates that all firms will likely need to revise their methodologies to some extent to implement the new standard. For example, all firms will need to update their methodologies to ensure that negative confirmation requests are not used as the sole source of audit evidence. NAF methodologies will likely require more revisions than the GNF methodologies, which have incorporated certain concepts included in the new standard.

Use of Technology-Based Tools

The PCAOB staff has also reviewed information collected through PCAOB oversight activities on firms' use of technology-based tools in the confirmation process. The staff's review focused primarily on the use of technology-based tools by GNFs, but also encompassed certain technology-based tools used by some NAFs. In addition, the review encompassed information on both proprietary technology-based tools that firms have developed internally and third-party or “off-the-shelf” tools that firms purchase and use (in certain cases, with further customizations) to assist in performing confirmation procedures as part of the audit process. The staff found that the number of technology-based tools used in the confirmation process varies across firms, and also varies based on the facts and circumstances of specific engagements. Generally speaking, firms allow engagement teams to select a tool but do not provide that the use of one or more tools is required.

Both GNFs and NAFs within the scope of the PCAOB staff's review use third-party tools to automate certain confirmation procedures, or to independently verify balances, terms of arrangements, or other information under audit. GNFs appear to be more likely to invest in customizing off-the-shelf tools they have purchased to their particular environment. For example, such modifications may permit a firm to automate the reconciliation of confirmed balances to client records. In comparison, NAFs tend to use the off-the-shelf tools without customization.

The PCAOB staff's review also found that GNFs have developed proprietary applications to facilitate various aspects of the confirmation process, whether conducted manually or electronically. These applications may facilitate the preparation of confirmation requests, their dissemination to recipients (including the preparation of logs to track confirmation requests and receipts), and the analysis of confirmation responses to determine their completeness and accuracy. GNFs have also developed tools used when auditing specific accounts, other than cash and accounts receivable, where confirmation may provide audit evidence. For example, tools are used to prepare, log, and track confirmation requests and responses for various deposit, loan, and liability accounts.

As discussed above, auditors or confirming parties may engage an intermediary to facilitate the direct electronic transmission of confirmation requests and responses between the auditor and the confirming party.^[81] In one area, market forces have influenced firms' willingness to use an intermediary: a majority of financial institutions will only respond to confirmation requests through a centralized process and with a specified intermediary. As a result, all firms' methodologies required, and in practice firms did use, the specified intermediary in these circumstances.

The PCAOB staff has observed diverse practices related to the procedures auditors perform to support their reliance on an intermediary's controls when establishing direct communication between the auditor and the confirming party.^[82] In some situations where the procedures performed included obtaining a SOC report, the staff has observed insufficient evaluation of SOC reports, lack of consideration of the period covered and complementary user entity controls, and insufficient coordination of procedures performed centrally by the audit firm and by the engagement team.^[83]

These observations suggest that there may be a need for uniform guidance for situations involving the use of intermediaries. For example, enhanced procedures to be performed when auditors place reliance on an intermediary's controls could help address the risk of interception and alteration of communications between the auditor and the company and address the risk of override of the intermediary's controls by the company.

Commenters did not provide information about firms' use of technology-based tools that contradicted the staff's assessment. One commenter stated that some larger audit firms have established confirmation centers to centralize the sending and receiving of confirmation requests. Another commenter cited a study that noted the use of robotic process automation for confirming accounts receivable by a GNF.^[84]

Literature on the Confirmation Process

There is limited data on auditor confirmation decisions and research findings on the confirmation process.^[85] The literature documents that confirmation is “extensively used” and that confirmation responses received directly from a third party are often perceived by practitioners to be among “the most persuasive forms of audit evidence.” ^[86] Consistent with the PCAOB staff's observations from PCAOB oversight activities,^[87] studies find that the use of electronic confirmation has become prevalent.^[88] One study also observes that current U.S. auditing standards do not fully address how auditors should authenticate confirmations sent or received electronically, and asserts that there is a need for audit guidance related to electronic forms of evidence.^[89] Further, an earlier study reviews enforcement actions described in the SEC's Accounting and Auditing Enforcement Releases and concludes that additional direction regarding when cash and accounts receivable confirmation requests are required or recommended may be needed.^[90] Additionally, the literature suggests that more guidance may be necessary to identify when the risk is sufficiently low to justify the use of negative confirmation requests in certain areas.^[91] Moreover, an article on bank confirmation advocates a risk-based approach to the determination of confirmation procedures.^[92] Finally, a study finds that “anecdotal evidence and some research suggest confirmation response rates are declining.” ^[93] Commenters did not provide information contradicting the staff's summary of the relevant literature.

Accordingly, the academic literature is consistent with the conclusion that the Board's auditing requirements for the confirmation process should (i) accommodate electronic communications and address the implications of using an intermediary, (ii) address the confirmation of cash and accounts receivable, (iii) limit the use of negative confirmation requests, and (iv) align with the PCAOB's risk assessment standards.

Need

Several attributes of the audit market support a need for the PCAOB to establish effective audit performance standards. First, the company under audit, investors, and other financial statement users cannot easily observe the services performed by the auditor or the quality of the audit. This leads to a risk that, unbeknownst to the company, investors, or other financial statement users, the auditor may perform a low-quality audit.^[94]

Second, the federal securities laws require that an issuer retain an auditor for the purpose of preparing or issuing an audit report. While the appointment, compensation, and oversight of the work of the registered public accounting firm conducting the audit is, under the Act, entrusted to the issuer's audit committee,^[95] there is nonetheless a risk that the auditor may seek to satisfy the interests of the issuer audit client rather than the interests of investors and other financial statement users.^[96] This risk can arise out of an audit committee's identification with the company or its management ( e.g., for compensation) or through management's exercise of influence over the audit committee's supervision of the auditor, which can result in a de facto principal-agent relationship between the company and the auditor.^[97] Effective auditing standards help to address these risks by explicitly assigning responsibilities to the auditor that, if executed properly, are expected to lead to high-quality audits that satisfy the interests of audited companies, investors, and other financial statement users.

This section discusses the specific problem that the new standard is intended to address and explains how the new standard is expected to address it.

Problem To Be Addressed

Focus on Obtaining Reliable Audit Evidence From the Confirmation Process

In situations where audit evidence can be obtained from a knowledgeable external source, the resulting audit evidence is likely to be more reliable than audit evidence obtained only from internal company sources. For evidence obtained through confirmation to be reliable, the confirmation process must be properly executed. Proper execution involves assessing the reliability of a confirmation response and performing robust, additional alternative procedures when the auditor is unable to determine that a confirmation response is reliable. Similarly, proper execution may entail the performance of alternative procedures when the auditor is unable to identify a confirming party, the auditor does not receive a confirmation response from the intended confirming party, or the confirmation response is incomplete.

As discussed above, the PCAOB staff has observed situations where auditors did not perform procedures to assess the reliability of confirmation responses or, where applicable, perform sufficient alternative procedures.^[98] In addition, the staff has noted that, in the case of some financial reporting frauds, the company's misconduct possibly could have been detected at an earlier point in time had the auditor made an appropriate assessment of the reliability of confirmation responses received, or performed additional procedures needed to obtain reliable audit evidence.^[99] These observations suggest a need for enhancements to auditing standards to more clearly address those situations where confirmation can be expected to provide reliable audit evidence, including the requirements for evaluating the reliability of confirmation responses and, if appropriate, performing alternative procedures.

Developments in Practice

There are areas of the confirmation process where developments in practice have outpaced existing requirements in the Board's auditing standards. In particular, existing AS 2310 does not reflect significant changes in technology and the methods by which auditors perform the confirmation process, including the use of electronic communication and the involvement of third-party intermediaries.

Regulatory standards that do not reflect changes in practice may lead to inconsistency in their application, potential misinterpretation, and ineffective regulatory intervention. For example, the PCAOB staff has observed diverse practices and audit deficiencies related to the procedures performed by auditors to support their use of an intermediary to facilitate the electronic transmission of confirmation requests and confirmation responses with confirming parties.^[100]

How the New Standard Addresses the Need

The new standard helps address the need by (i) strengthening requirements in certain areas to focus on the need to obtain reliable audit evidence from the confirmation process; and (ii) modernizing existing AS 2310 to accommodate certain developments in practice, including the use of electronic communications and intermediaries. The new standard is expected to promote consistent and effective practice relating to the confirmation process in audits subject to PCAOB standards, reducing the risk of low-quality audits caused by (i) the lack of observability of audit quality and (ii) the influence of the auditor-client relationship discussed above.

Focus on Obtaining Reliable Audit Evidence From the Confirmation Process

The new standard strengthens the Board's requirements in certain areas to focus on the need to obtain reliable audit evidence when executing the confirmation process. Specifically, the new standard includes a presumption for the auditor to confirm certain cash and cash equivalents held by third parties, or otherwise obtain relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source. In addition, the new standard strengthens the requirements for evaluating the reliability of confirmation responses. It also continues to emphasize the importance of maintaining control over the confirmation process and provides additional examples of information that indicates that a confirmation request or response may have been intercepted and altered. When confirmation responses are deemed to be unreliable, the auditor is directed to perform alternative procedures to obtain audit evidence.

Moreover, as discussed above, electronic communications likely have reduced the efficacy of negative confirmation requests. Under the new standard, the auditor is not able to use negative confirmation requests as the sole substantive procedure for addressing the risk of material misstatement for a financial statement assertion.

Developments in Practice

Under the new standard, the requirement to maintain control over the confirmation process addresses both traditional and newer, more prevalent forms of communication between the auditor and confirming parties, including emailed confirmation requests and responses and intermediaries facilitating electronic communication of confirmation requests and responses. The new standard is intended to apply to methods of confirmation currently in use and to be flexible enough to apply to new methods that may arise from technological changes in auditing in the future.

The new standard emphasizes that in general, evidence obtained from a knowledgeable external source is more reliable than evidence obtained only from internal company sources. For cash and accounts receivable, if the auditor is able to perform audit procedures other than confirmation that allow the auditor to obtain audit evidence by directly accessing information maintained by knowledgeable external sources, such audit evidence could be as persuasive as audit evidence obtained through confirmation procedures, and the new standard allows the auditor to perform such procedures. Accordingly, to the extent that there are newer tools available to auditors now or in the future that enable them to obtain such audit evidence directly, the new standard would accommodate their use and future development.

Economic Impacts

This section discusses the expected benefits and costs of the new standard and potential unintended consequences. Overall, the Board expects that the economic impact of the new standard, including both benefits and costs, will be relatively modest, especially for those firms that have already incorporated into practice some of the new requirements. The Board also expects that the benefits of the new standard will justify the costs and any unintended negative effects.

Benefits

The Board expects the new standard to improve the consistency and effectiveness of the confirmation process, reducing the risk of low-quality audits caused by (i) the lack of observability of audit quality and (ii) the influence of the auditor-client relationship discussed above. Specifically, there exists a risk that, unbeknownst to the company under audit, investors, or other financial statement users, the auditor may perform a low-quality audit since audit quality is difficult to observe. In addition, some auditors may aim to satisfy the interests of the company or their own financial interests rather than the interests of investors and other financial statement users—interests that may lead them to perform insufficiently rigorous confirmation procedures to minimize the burden on clients and their counterparties to respond to confirmations, or to minimize audit costs.

The new standard helps to mitigate these risks in the audit confirmation process by strengthening and modernizing the requirements for the auditor regarding the design and execution of the confirmation process. Specifically, a confirmation process designed and executed under the new standard should benefit investors and other users of financial statements by reducing the likelihood that financial statements are materially misstated, whether due to error or fraud. Some commenters explicitly stated that the requirements described in the 2022 Proposal would improve the consistency of confirmation practices and enhance audit quality.

The enhanced quality of audits and financial information available to financial markets should also increase investor confidence in financial statements. In general, investors may use the more reliable financial information to improve the efficiency of their capital allocation decisions ( e.g., investors may reallocate capital from less profitable companies to more profitable companies). Investors may also perceive less risk in capital markets generally, leading to an increase in the supply of capital. An increase in the supply of capital could increase capital formation while also reducing the cost of capital to companies.^[101]

Auditors also are expected to benefit from the new standard, because the additional clarity provided by the new standard ( e.g., the accommodation of current practices, including the use of electronic communications and intermediaries) will reduce regulatory uncertainty and the associated compliance costs. Specifically, the new standard provides auditors with a better understanding of their responsibilities and the Board's expectations.

The following discussion describes the benefits of key changes to existing confirmation requirements that are expected to impact auditor behavior. As discussed above, the changes aim to (1) enhance the auditor's focus on obtaining reliable audit evidence from the confirmation process, and (2) accommodate certain developments in practice. As further discussed below, the changes that enhance the auditor's focus on obtaining reliable audit evidence are expected to strengthen confirmation procedures for cash held by third parties, promote consistency in practice, improve the reliability of confirmation responses, improve the quality of audit evidence, and increase the auditor's likelihood of identifying potential financial statement fraud. The changes that accommodate developments in practice are expected to clarify the auditor's responsibilities regarding the use of electronic communications in the confirmation process, standardize the procedures that auditors perform to support their use of intermediaries, and allow for the use or development of more sophisticated and effective technology-based auditing tools. To the extent that a firm has already implemented certain of the provisions of the new standard into its firm methodology, the benefits described below will be reduced.

Focus on Obtaining Reliable Audit Evidence From the Confirmation Process

The new standard should benefit investors and other users of a company's financial statements by placing additional emphasis on the auditor's need to obtain reliable audit evidence when performing confirmation procedures. In this regard, the new standard: (1) identifies certain accounts for which the auditor should perform confirmation procedures, (2) enhances the requirements for assessing the reliability of confirmation responses, (3) addresses the performance of alternative procedures when the auditor is unable to obtain relevant and reliable audit evidence through confirmation, (4) strengthens requirements regarding the use of negative confirmation requests, and (5) specifies certain activities in the confirmation process that should be performed by the auditor and not by other parties.

Specifically, the new presumption for the auditor to confirm certain cash and cash equivalents held by third parties or otherwise obtain relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source may reduce the risk of material errors in financial statements and strengthen investor protection to the extent that auditors are not already confirming cash pursuant to their existing audit methodologies.^[102] This requirement also specifies that the extent of audit evidence to obtain through cash confirmation procedures should be based on the auditor's understanding of the company's cash management and treasury function.

The standard does not require that all cash accounts or all accounts receivable should be selected for confirmation. The auditor's assessment of the risk of material misstatement is an important consideration when designing audit procedures, including the use of confirmation. Consistent with the objective of the new standard, the requirement to confirm cash and accounts receivable, or otherwise obtain relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source, only applies when the auditor has determined that these accounts are significant accounts. Further, for both cash and accounts receivable, the new standard specifies that the auditor should take into account the auditor's understanding of the substance of a company's arrangements and transactions with third parties when selecting the individual items to confirm. These provisions in the new standard should encourage the auditor to determine the extent of confirmation procedures with regard to an assessment of the risk of material misstatement and avoid more work than necessary to obtain sufficient appropriate audit evidence.

However, to the extent that cash or accounts receivable fall within the scope of the new standard, the new standard strengthens the requirement to obtain relevant and reliable audit evidence, whether through performing confirmation procedures or otherwise obtaining audit evidence by directly accessing information maintained by a knowledgeable external source. At the same time, the new standard also addresses situations where, based on the auditor's experience, confirmation would not be feasible for accounts receivable. The additional clarity provided by these requirements in the new standard should reduce uncertainty in auditor responsibilities and promote consistency in practice with respect to the confirmation of cash and accounts receivable.

The new standard strengthens requirements addressing the reliability of confirmation responses by describing information that the auditor should take into account when evaluating the reliability of confirmation responses and providing examples of information that indicates that a confirmation request or response may have been intercepted or altered. These requirements are expected to improve the reliability of confirmation responses and therefore increase the quality of the audit evidence obtained by the auditor.

The requirement to communicate to the audit committee instances where, for significant risks associated with cash or accounts receivable, the auditor did not perform confirmation procedures or obtain audit evidence by directly accessing information maintained by a knowledgeable external source is expected to reinforce the auditor's obligation to exercise due professional care in determining not to perform confirmation procedures or otherwise obtain audit evidence by directly accessing information maintained by a knowledgeable external source.

The new standard also expands on the existing requirement to address the auditor's potential need to apply alternative procedures. The enhanced requirements for alternative procedures provide a greater level of detail and clarity to auditors for situations that are not currently addressed explicitly in existing AS 2310, potentially raising the quality of evidence obtained by auditors.

Under the new standard, the auditor may only use negative confirmation requests to supplement other substantive audit procedures; negative confirmation requests may not be used as the sole substantive audit procedure. As discussed above, the amount of electronic correspondence has increased dramatically over the years, leading to an increased likelihood that a negative confirmation request would not be appropriately considered by the confirming party and, therefore, would provide less persuasive audit evidence. The new standard addresses this issue by providing examples of situations in which negative confirmation requests, in combination with the performance of other substantive audit procedures, may provide sufficient appropriate audit evidence. As negative confirmation requests cannot be the sole source of audit evidence obtained, insofar as the new standard affects practice, the overall quality of audit evidence obtained by the auditor likely will increase.^[103]

Overall, the additional requirements and examples discussed above are expected to improve the reliability of confirmation responses and, therefore, increase the quality of the audit evidence obtained by the auditor. By introducing a new requirement to confirm certain cash balances (or otherwise obtain relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source) and enhancing the requirements for evaluating the reliability of confirmation responses, the new standard may also increase the auditor's likelihood of identifying potential financial statement fraud. Early detection of accounting fraud is an important aspect of investor protection because such fraud can cause significant harm to investors in the companies engaged in fraud, as well as indirect harm to investors in other companies.^[104] In addition, by clarifying and strengthening the auditor's responsibilities, including by specifying additional situations where alternative procedures may be necessary and providing additional examples of information that indicates that a confirmation request or response may have been intercepted and altered, the new standard takes into account past inspection findings by the Board that auditors did not obtain sufficient appropriate audit evidence when using confirmation.

One commenter on the proposing release expressed the view that the proposed standard would not achieve a significant reduction in inspection findings or improvements to audit quality because adverse inspection findings have historically focused on a failure to appropriately execute existing requirements. As discussed above, however, the need for this rulemaking is not limited to noncompliance with the current standard detected through our inspections program, but also reflects undetected financial reporting frauds and developments in practice. The Board continues to believe, therefore, that the rule will achieve its intended benefits, which include increased clarity from the new standard.

Developments in Practice

The new standard modernizes existing AS 2310 by accommodating certain developments in practice, including the use of electronic communications and intermediaries.

Specifically, the new standard accommodates changes in how communications occur between the auditor and confirming parties. It clarifies the auditor's responsibilities by taking into account current confirmation practices among auditors and acknowledging differing methods of confirmation. These methods include longstanding methods, such as the use of paper-based confirmation requests and responses sent via postal mail. They also include methods that have become commonplace since the existing standard was adopted, including confirmation requests and responses communicated via email and the use of intermediaries to facilitate the direct electronic transmission of confirmation requests and responses. This additional clarity may enhance the reliability of audit evidence by decreasing the risk that a confirmation request or response is intercepted and altered. In addition, the new standard includes requirements specific to an intermediary's controls that mitigate the risk of interception and alteration. The requirements are expected to standardize the procedures auditors perform to support their use of intermediaries and reduce audit deficiencies in this area.

With regard to both cash and accounts receivable, the new standard accommodates the potential for future evolution of audit tools by allowing auditors to directly obtain access to relevant and reliable audit evidence from knowledgeable external sources other than through confirmation without the involvement of the company. This change allows for the use or development of technology-based auditing tools, subject to the requirement that they provide audit evidence by directly accessing information maintained by knowledgeable external sources about the relevant financial statement assertion. Accordingly, this change could potentially improve the efficiency and effectiveness of the audit.

Some commenters on the 2022 Proposal questioned the benefits of the proposed requirements, arguing that the auditor's inability under the proposed standard to overcome the presumption to confirm cash and a high threshold to overcome the presumption to confirm accounts receivable unduly restricted the ability to use professional judgment to determine the appropriateness of confirmation procedures. While the Board agrees that professional judgment plays an important role in the execution of audit procedures, the Board's experience indicates that it is also important for investor protection that auditors obtain relevant and reliable audit evidence for both cash and accounts receivable when they are significant accounts. With regard to accounts receivable, the new standard retains the presumption to perform audit procedures to obtain relevant and reliable evidence through confirmation, or otherwise by directly accessing information maintained by a knowledgeable external source, so would not decrease or remove the auditor's current responsibility. Furthermore, the new standard includes a provision to address situations when obtaining audit evidence directly from knowledgeable external sources, whether through confirmation procedures or other means, would not be feasible to execute for accounts receivable. Accordingly, the new standard strikes a balance intended to benefit investors by recognizing the value of professional judgment generally with respect to the use of confirmation while ensuring that cash and accounts receivable, when they are significant accounts, are subject to confirmation or other audit procedures designed to obtain relevant and reliable audit evidence from knowledgeable external sources.

Costs

The Board expects the costs associated with the new standard to be relatively modest. The PCAOB staff's review of audit firm methodologies related to the confirmation process indicates that some firms have already incorporated into practice some of the new requirements. For example, the methodologies of some GNFs include requirements for confirmation of cash that are similar to the requirements in the new standard. Both the GNF and NAF methodologies reviewed generally include guidance on maintaining control over the confirmation process and the use of intermediaries to facilitate the electronic transmission of confirmation requests and responses.

To the extent that audit firms need to make changes to meet the new requirements, they may incur certain fixed costs ( i.e., costs that are generally independent of the number of audits performed) to implement the new standard. These include costs of updating audit methodologies and tools, and costs to prepare training materials and conduct internal training. GNFs are likely to update methodologies using internal resources, whereas NAFs are more likely to purchase updated methodologies from external vendors. The costs of updating these methodologies likely depend on the extent to which the new requirements have already been incorporated in the firms' current methodologies. For firms that have implemented confirmation procedures like those required by the new standard, the costs of updating methodologies may be lower than for firms that currently do not have such procedures. In this regard, large firms may also benefit from economies of scale. As mentioned above, one commenter indicated that some larger audit firms have already established confirmation centers to centrally process the sending of confirmation requests and receiving of confirmation responses. For these firms, costs to implement the new standard may be further diminished as these firms may benefit from lower training costs and more efficient performance of the enhanced procedures. Smaller audit firms may not have adequate resources to establish such confirmation centers and may not recognize similar efficiency gains. The commenter observed that the establishment of confirmation centers within audit firms would require significant resources, which smaller audit firms may not have.

In addition, audit firms may incur certain engagement-level variable costs related to implementing the new standard. For example, the requirement to confirm certain cash balances or otherwise obtain relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source could impose engagement-level costs on some auditors if additional procedures need to be performed. Similarly, limiting the use of negative confirmation requests to situations where the auditor is also performing other substantive audit procedures could lead to additional time and effort by the auditor to perform the other audit procedures.

The magnitude of the variable costs likely depends on the extent to which existing practice differs from the new requirements. As discussed above, the PCAOB staff's review of firm methodologies, which included the methodologies of certain NAFs, suggests that the new standard likely will lead to a greater impact on confirmation procedures performed by smaller firms. Because the new standard generally applies a risk-based approach ( i.e., by providing that the use of confirmation may be part of the auditor's response to the assessed risks of material misstatement), the costs of performing the additional procedures are unlikely to be disproportionate to the benefits.

To the extent that auditors incur higher costs to implement the new standard and are able to pass on at least part of the increased costs through an increase in audit fees, companies being audited could incur an indirect cost.^[105] Moreover, confirming parties could incur additional costs from supporting the confirmation process as a result of the enhanced requirements of the new standard, although the additional costs are expected to be limited. One commenter agreed that confirming parties may incur additional costs as they may have to allocate resources to respond to confirmation requests. As discussed above, however, confirmation is already commonly used by audit firms, and the Board therefore does not expect confirming parties to incur significant additional costs to respond to confirmation requests as a result of the new standard.

Some requirements under the new standard may result in more costs than others. The following discussion describes the potential costs associated with specific changes to existing confirmation requirements.

Focus on Obtaining Reliable Audit Evidence From the Confirmation Process

The new standard: (1) identifies certain accounts for which the auditor should perform confirmation procedures or otherwise obtain relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source, (2) enhances the requirements for assessing the reliability of confirmation responses, (3) addresses the performance of alternative procedures when the auditor is unable to obtain relevant and reliable audit evidence through confirmation, (4) strengthens requirements regarding the use of negative confirmation requests, and (5) specifies certain activities in the confirmation process that should be performed by the auditor and not by other parties.

For some firms, the requirement in the new standard to confirm certain cash balances or otherwise obtain relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source could be expected to result in the revision of firm methodologies and the performance of additional audit procedures. As discussed above, the methodologies of some GNFs already include requirements for cash confirmation that are similar to the new requirement described in the new standard. In addition, the risk-based approach in the new requirement should encourage the auditor to determine the extent of confirmation with regard to an assessment of the risks of material misstatement and conduct only the work necessary to obtain sufficient audit evidence.

Commenters on the 2022 Proposal asserted that confirming cash balances under the proposed standard would lead to increased costs, given the lack of discretion and ability to overcome the presumption in the proposed standard. In addition, some commenters on the 2022 Proposal asserted that the “at least as persuasive as” threshold in the proposed standard for overcoming the presumption to confirm accounts receivable would limit the auditor's use of professional judgment and could result in greater costs without a commensurate benefit to audit quality.

As discussed above, there is a presumption in the new standard that the auditor should obtain audit evidence from a knowledgeable external source by performing confirmation procedures or using other means to obtain audit evidence by directly accessing information maintained by knowledgeable external sources. In addition, the new standard provides that if, based on the auditor's experience, it would not be feasible for the auditor to obtain audit evidence about accounts receivable pursuant to paragraph .24, the auditor should obtain external information indirectly by performing other substantive procedures, including tests of details. Insofar as the final standard does not otherwise provide auditors with the discretion to avoid obtaining audit evidence directly from a knowledgeable external source for cash, and the only exception applicable to accounts receivable is for situations where obtaining audit evidence directly from a knowledgeable external source would not be feasible, firms may, therefore, incur additional costs to comply with the presumptive requirements of the new standard for cash and accounts receivable. These costs, however, are necessary to the achievement of the standard's intended benefits of emphasizing the quality and strength of the audit evidence to be obtained from knowledgeable external sources.

The new standard also requires the auditor to evaluate the reliability of confirmation responses and provides examples of information that indicate that a confirmation response may have been intercepted and altered. The costs associated with this requirement, however, are expected to be limited. First, the Board's auditing standards already require the auditor to obtain sufficient appropriate audit evidence to provide a reasonable basis for the auditor's report, and to evaluate the combined evidence provided by confirmation and other auditing procedures performed when the auditor has not received replies to confirmation requests ( i.e., nonresponses) to determine whether sufficient evidence has been obtained about all the applicable financial statement assertions.^[106] Second, the methodologies of some firms reflect application material in ISA 505 regarding factors (similar to indicators in the new standard) that may indicate doubts about the reliability of a confirmation response. One of these factors is analogous to the requirement in the new standard ( i.e., the confirmation response appears not to come from the originally intended confirming party), which may further limit the potential costs for firms that have incorporated this factor in their methodologies. One commenter on the 2022 Proposal stated that the proposed standard's requirement for evaluating the reliability of confirmation responses might cause the auditor to need to authenticate confirmation responses, which would add significant expense to the audit. However, as discussed above, AS 1105 already establishes the requirements for evaluating the reliability of audit evidence, and the new standard does not change those requirements.

The requirement for the auditor to communicate with the audit committee when the auditor did not perform confirmation procedures or otherwise obtain audit evidence by directly accessing information maintained by knowledgeable external sources for significant risks associated with either cash or accounts receivable could impose a modest incremental cost. Some commenters on the 2022 Proposal had expressed concern about the proposed requirement to communicate with the audit committee in all instances where the presumption to confirm accounts receivable had been overcome, which could be detrimental if the communication became a mere compliance exercise for auditors and audit committees. The new standard's requirement to communicate with the audit committee, however, is more risk-based and therefore, the Board continues to believe that the incremental costs will be modest.

Insofar as the new standard identifies additional situations in which the auditor generally would be required to perform alternative procedures, firms may incur additional costs. Specifically, the new standard extends the requirement in existing AS 2310 to perform alternative procedures in relation to nonresponses to positive confirmation requests to other situations, including the auditor's inability to identify a confirming party and the receipt of an unreliable response.

In contrast with existing AS 2310, negative confirmation requests may not be used as the sole substantive audit procedure under the new standard. This limitation reflects, among other things, the increase in the volume of electronic correspondence since existing AS 2310 was issued and the increasing likelihood that a recipient of a negative confirmation request would not consider the request. As a result, auditors may have to perform other substantive audit procedures for certain financial statement assertions. Although the Board understands through its oversight activities that few, if any, GNFs use negative confirmation requests as the sole substantive procedure in practice, as discussed above, the PCAOB staff's firm methodology review suggests that all the GNFs and NAFs reviewed will need to review their methodologies to ensure that negative confirmation requests are not used as the sole source of audit evidence.

Developments in Practice

As discussed above, the new standard includes requirements that clarify the procedures auditors should perform to support their use of intermediaries to facilitate the direct electronic transmission of confirmation requests and responses between the auditor and the confirming party. These requirements may lead to modifications to firm methodologies. Further, the required procedures may involve additional auditor time and effort. The resulting costs likely depend on the extent to which the new requirements have already been incorporated in a firm's current methodologies. One commenter expressed concern that the proposed requirement to assess the intermediary's controls would result in significant additional work for auditors because it is not currently common practice to directly assess intermediaries in this manner. The PCAOB staff's review of firm methodologies discussed above did not suggest that the requirements in Appendix B of the new standard would create significant additional work for auditors. In particular, both the GNF and NAF methodologies reviewed generally already include guidance on maintaining control over the confirmation process and the use of intermediaries, which may limit the costs. In addition, the Board notes that the requirements in the new standard relate to relevant controls that address the risk of interception and alteration of confirmation requests and responses and that some intermediaries currently make information about relevant internal controls available to auditors through a SOC report.

If the auditor is able to obtain audit evidence by directly accessing information maintained by knowledgeable external sources instead of confirmation, such audit evidence could be at least as persuasive as audit evidence obtained through confirmation procedures, and the new standard allows the auditor to perform such procedures. This provision is not expected to impose new costs on firms, as firms would only obtain relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source to the extent that technological advancements render it more efficient than performing confirmation procedures. Thus, to the extent that the auditor is able to replace confirmation procedures with obtaining audit evidence by directly accessing information maintained by a knowledgeable external source, the new standard could reduce costs for firms.

Potential Unintended Consequences

In addition to the benefits and costs discussed above, the new standard could have unintended economic impacts. The following discussion describes potential unintended consequences the Board has considered and, where applicable, factors that mitigate the negative consequences, such as steps the Board has taken or the existence of other countervailing forces.

Potential Decline in Auditors' Usage of Confirmation

An unintended consequence of the new standard would occur if, contrary to the Board's expectation, there were a significant reduction in the use of confirmation procedures by auditors in circumstances where confirmation would provide relevant and reliable audit evidence.

Under the new standard, auditors retain the ability to use confirmation as one procedure, among others, to audit one or more financial statement accounts or disclosures. At the same time, the new standard strengthens the requirements for an auditor regarding evaluating the reliability of confirmation responses and addressing confirmation exceptions and incomplete responses, including performing alternative procedures to obtain audit evidence. Further, the new standard describes the types of procedures the auditor should perform in evaluating the effect of using an intermediary on the reliability of confirmation requests and responses, including determining whether relevant controls of the intermediary are designed and operating effectively. In addition, the new standard does not allow the auditor to use negative confirmation requests as the sole substantive procedure. As a result, when not required to use confirmation, auditors might decline to use confirmation and use other audit procedures more frequently than under existing AS 2310 if they perceive there could be more time or cost involved in the confirmation process relative to the performance of other procedures.

This potential unintended consequence is mitigated, however, by the requirement that the auditor should perform confirmation procedures for cash and accounts receivable, or otherwise obtain audit evidence by directly accessing information maintained by knowledgeable external sources. In addition, the Board's standards already provide that the auditor should evaluate whether the combined evidence provided by confirmation and other auditing procedures provide sufficient evidence about the applicable financial statement assertions. Several of the changes to existing requirements in the new standard align with the Board's understanding of current practice. For example, many audit firms' methodologies include guidance on maintaining control and the use of intermediaries. Additionally, the potential unintended consequence may be mitigated to the extent that a firm has experienced efficiencies from using newer audit tools for confirmation through reduced time or costs. Further, the Board does not anticipate that the requirements of the new standard will cause a significant change in the timing or extent of confirmation procedures for auditors, as the Board has not amended the requirements of AS 2301, which is the auditing standard that addresses those matters. Accordingly, the Board does not believe that the new standard will lead to a significant decline in the use of confirmation.

Potential Misinterpretation of the Requirements in the New Standard Relating to the Confirmation of Cash and Accounts Receivable

An unintended consequence of the presumed requirement in the new standard to confirm cash and accounts receivable would arise if auditors misinterpreted the language in the new standard as requiring the confirmation of cash and accounts receivable in all situations. For example, the new standard does not carry forward a provision included in existing AS 2310 that an auditor could overcome the presumption to confirm accounts receivable if, among other things, “[t]he use of confirmations would be ineffective.” It is possible that some auditors might misinterpret the elimination of this language as precluding the exercise of auditor judgment with respect to the confirmation of accounts receivable. Some commenters on the 2022 Proposal appeared to misinterpret the proposed requirement and suggested that confirmation would be required in all situations. For example, one commenter asserted that using confirmation regardless of risk assessment may promote a checklist mentality that does not contribute to audit quality and an audit approach that may be less efficient and effective.

The Board does not intend, however, that an auditor send confirmation requests for accounts receivable in all situations or when such procedures do not provide relevant and reliable audit evidence. If the auditor has not determined cash or accounts receivable to be a significant account, the new standard does not require the confirmation of cash or accounts receivable. Moreover, to clarify the Board's intent, it has modified the language in the proposed standard in several respects. First, paragraph .25 of the new standard addresses situations when obtaining audit evidence about accounts receivable directly from knowledgeable external sources, whether through confirmation procedures or other means, would not be feasible to execute. If it is not feasible for the auditor to obtain audit evidence about accounts receivable directly from a knowledgeable external source, the auditor should obtain external information indirectly by performing other substantive procedures, including tests of details.

In addition, the Board is not adopting paragraph .07 of the proposed standard, which referred to situations where evidence obtained through the confirmation process “generally is more persuasive than audit evidence obtained solely through other procedures” and may have contributed to a misperception that the Board was proposing to require confirmation in all circumstances. In the Board's view, the language in the new standard acknowledges the role of professional judgment in the auditor's selection of audit procedures to obtain sufficient appropriate audit evidence, while retaining a presumption to confirm cash and accounts receivable or otherwise obtain relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source. This should mitigate the potential unintended consequence described above.

Alternatives Considered

The development of the new standard involved considering a number of alternative approaches to address the problems described above. This section explains: (i) why standard setting is preferable to other policy-making approaches, such as providing interpretive guidance or enhancing inspection or enforcement efforts; (ii) other standard-setting approaches that were considered; and (iii) key policy choices made by the Board in determining the details of the new standard-setting approach.

Why Standard Setting Is Preferable to Other Policy-Making Approaches

The Board's policy tools include alternatives to standard setting, such as issuing additional interpretive guidance, or increasing our focus on inspections or enforcement of existing standards. The Board considered whether providing guidance or increasing inspection or enforcement efforts would be effective mechanisms to address concerns with the auditor's use of confirmation.

Interpretive guidance inherently provides additional information about existing standards. Inspection and enforcement actions take place after insufficient audit performance (and potential investor harm) has occurred. Devoting additional resources to interpretive guidance, inspections, or enforcement activities, without improving the relevant performance requirements for auditors, would at best focus auditors' performance on existing standards and would not provide the benefits discussed above associated with improving the standards. The new standard, on the other hand, is designed to improve existing requirements for the auditor's use of confirmation. For example, the new standard, unlike existing AS 2310, includes requirements relating to the confirmation of cash accounts, imposes additional limitations on the use of negative confirmation requests, clarifies the circumstances in which auditors would be expected to perform alternative procedures, and includes explicit provisions addressing the auditor's responsibility for selecting items to be confirmed, sending confirmation requests, and receiving confirmation responses.

Other Standard-Setting Alternatives Considered

Several alternative standard-setting approaches were also considered, including: (i) making amendments to the existing standard; and (ii) adopting an approach based on ISA 505, with certain modifications to reflect the PCAOB's statutory responsibilities with respect to audits of public companies and registered broker-dealers.

Amendments to Existing Standard

The Board considered, but decided against, limiting the amendments to AS 2310 solely to modifications relating to changes in technology that have affected the confirmation process. While this approach could result in fewer changes to firms' audit methodologies, the Board believes there are a number of other areas discussed throughout this release, beyond amending AS 2310 to reflect the increasing use of technology in the confirmation process, where the existing standard should be improved.

Standard Based on ISA 505

Some commenters on the 2009 Concept Release and the 2010 Proposal suggested that the Board should consider adopting ISA 505, the IAASB's standard on audit confirmation, which was issued in 2008. The Board has taken the requirements and application material of ISA 505 into account in developing the new standard ( e.g., the ISA 505 application material relating to the use of a third party to coordinate and provide responses to confirmation requests).

The Board concluded, however, that the new standard should also establish certain requirements that are not included in ISA 505 ( e.g., requirements to confirm cash and accounts receivable or otherwise obtain relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source), and should not include certain provisions that are described in ISA 505 ( e.g., regarding management's refusal to allow the auditor to send a confirmation request). In addition, audit practices have continued to evolve since ISA 505 was issued in 2008, and the Board believes that the new standard should reflect these developments ( e.g., by addressing electronic communication and the use of intermediaries in the requirements of the standard rather than in application materials).

Key Policy Choices

Given a preference for replacing existing AS 2310 in its entirety, the Board considered different approaches to addressing key policy issues.

Use of Confirmation Procedures for Specific Accounts

The new standard provides that when addressing an assessed risk of material misstatement of cash and cash equivalents held by third parties, as well as of accounts receivable that arise from the transfer of goods or services to a customer or a financial institution's loans, the auditor should perform confirmation procedures or otherwise obtain relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source. In addition, under the new standard, when obtaining audit evidence from a knowledgeable external source regarding cash, the auditor should consider sending confirmation requests to that source about other financial relationships with the company, based on the assessed risk of material misstatement. Also, when the auditor has identified a complex transaction or a significant unusual transaction, the auditor should consider confirming those terms of the transaction that are associated with a significant risk of material misstatement, including a fraud risk. The new standard does not specify other significant accounts or disclosures that the auditor should confirm or consider confirming. The Board considered several alternatives to this approach, as discussed below.

First, the Board considered an approach that would have no requirement for the auditor to confirm specified accounts or transactions. In the Board's view, this approach might result in the selection by some auditors of audit procedures that provide less relevant and reliable audit evidence than confirmation with respect to cash and accounts receivable ( e.g., if an auditor mistakenly assessed the risk of material misstatement too low for cash or accounts receivable). Further, confirmation of cash and accounts receivable is already a standard practice for many auditors and is consistent with the concept that audit evidence obtained from a knowledgeable external source is more reliable than evidence obtained only from internal company sources. Accordingly, the Board has decided against an approach that does not require the confirmation of any accounts and disclosures in the new standard.

In addition, the Board considered including in the new standard a requirement that the auditor should confirm other accounts in addition to cash and accounts receivable, such as investments. The Board has decided against this approach because it would limit auditor judgment in circumstances where the performance of other auditing procedures might provide relevant and reliable audit evidence, could be viewed as unduly prescriptive, and would not allow the auditor to take company-specific facts and circumstances into account. Instead, under the new standard, the auditor could decide to perform confirmation procedures with respect to financial statement assertions relating to other accounts and disclosures but is not required to do so.

The Board also considered an additional requirement that the auditor should perform confirmation procedures in response to significant risks that relate to relevant assertions, when such assertions can be adequately addressed by confirmation procedures. However, the Board believes that such a requirement would be inconsistent with the Board's risk assessment standards, which allow for auditor judgment in determining the audit response to significant risks identified by the auditor. The Board has not included this provision in the new standard.

Management Requests Not To Confirm

The Board considered addressing situations where management requests that the auditor not confirm one or more items in the new standard. Specifically, the Board considered requiring the auditor to obtain an understanding of the reasons for management's request, perform alternative procedures as discussed in Appendix C of the new standard, and communicate the request to the audit committee. In addition, the Board considered a requirement that the auditor should evaluate the implications for the auditor's report if the auditor determines that management's request impairs the auditor's ability to obtain sufficient appropriate audit evidence or indicates that one or more fraud risk factors are present. For the reasons discussed above, the Board has decided not to include such provisions in the new standard.

Special Considerations for Audits of Emerging Growth Companies

Pursuant to Section 104 of the Jumpstart Our Business Startups Act (“JOBS Act”), rules adopted by the Board subsequent to April 5, 2012, generally do not apply to the audits of EGCs, as defined in Section 3(a)(80) of the Exchange Act, unless the SEC “determines that the application of such additional requirements is necessary or appropriate in the public interest, after considering the protection of investors, and whether the action will promote efficiency, competition, and capital formation.” ^[107] As a result of the JOBS Act, the rules and related amendments to PCAOB standards that the Board adopts are generally subject to a separate determination by the SEC regarding their applicability to audits of EGCs.

To inform consideration of the application of auditing standards to audits of EGCs, PCAOB staff prepares a white paper annually that provides general information about characteristics of EGCs.^[108] As of the November 15, 2021, measurement date, PCAOB staff identified 3,092 companies that self-identified with the SEC as EGCs and filed audited financial statements in the 18 months preceding the measurement date.

Confirmation is a longstanding audit procedure used in nearly all audits, including audits of EGCs. The discussion of benefits, costs, and unintended consequences above is generally applicable to audits of EGCs. The economic impacts of the new standard on an EGC audit depend on factors such as the audit firm's current methodologies, the audit firm's ability to distribute implementation costs across engagements, and the auditor's assessed risk of material misstatement.

EGCs are likely to be newer companies, which may increase the importance to investors of the external audit to enhance the credibility of management disclosures.^[109] Further, compared to non-EGCs, EGCs are more likely to be audited by NAFs.^[110] As discussed above, NAFs are expected to make more changes to their methodologies and practice to comply with the new standard. Therefore, all else equal, the benefits of the higher audit quality resulting from the new standard may be larger for EGCs than for non-EGCs, including improved efficiency of market capital allocation, lower cost of capital, and enhanced capital formation.^[111] In particular, because investors who face uncertainty about the reliability of a company's financial statements may require a larger risk premium that increases the cost of capital to companies, the improved audit quality resulting from applying the new standard to EGC audits could reduce the cost of capital to those EGCs.^[112]

While the associated costs may also be higher for EGC audits than for non-EGC audits, because of the scalability of the risk-based requirements, the costs of performing the procedures are unlikely to be disproportionate to the benefits of the procedures. Moreover, if any of the new amendments were determined not to apply to the audits of EGCs, auditors would need to address differing audit requirements in their methodologies, or policies and procedures, with respect to audits of EGCs and non-EGCs, which would create the potential for confusion. The new standard could impact competition in an EGC product market if the indirect costs to audited companies disproportionately impact EGCs relative to their competitors. However, as discussed above, the costs associated with the new standard are expected to be relatively modest. Therefore, the impact of the new standard on competition, if any, is expected to be limited. Overall, the new standard is expected to enhance audit quality and contribute to an increase in the credibility of financial reporting by EGCs.

Accordingly, and for the reasons explained above, the Board is requesting that the Commission determine that it is necessary or appropriate in the public interest, after considering the protection of investors and whether the action will promote efficiency, competition, and capital formation, to apply the new standard to audits of EGCs. One commenter specifically supported the application of the 2022 Proposal to EGCs.

III. Date of Effectiveness of the Proposed Rules and Timing for Commission Action

Within 45 days of the date of publication of this notice in the Federal Register or within such longer period (i) as the Commission may designate up to 90 days of such date if it finds such longer period to be appropriate and publishes its reasons for so finding or (ii) as to which the Board consents, the Commission will:

(A) By order approve or disapprove such proposed rules; or

(B) Institute proceedings to determine whether the proposed rules should be disapproved.

IV. Solicitation of Comments

Interested persons are invited to submit written data, views and arguments concerning the foregoing, including whether the proposed rules are consistent with the requirements of Title I of the Act. Comments may be submitted by any of the following methods:

Electronic Comments

• Use the Commission's internet comment form ( https://www.sec.gov/​rules/​pcaob); or

• Send an email to [e-mail]. Please include file number PCAOB–2023–02 on the subject line.

Paper Comments

• Send paper comments in triplicate to Vanessa A. Countryman, Secretary, Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549–1090.

All submissions should refer to file number PCAOB–2023–02. This file number should be included on the subject line if email is used. To help the Commission process and review your comments more efficiently, please use only one method. The Commission will post all comments on the Commission's internet website ( https://www.sec.gov/​rules/​pcaob). Copies of the submission, all subsequent amendments, all written statements with respect to the proposed rules that are filed with the Commission, and all written communications relating to the proposed rules between the Commission and any person, other than those that may be withheld from the public in accordance with the provisions of 5 U.S.C. 552, will be available for website viewing and printing in the Commission's Public Reference Room, 100 F Street NE, Washington, DC 20549, on official business days between the hours of 10 a.m. and 3 p.m. Copies of such filing will also be available for inspection and copying at the principal office of the PCAOB. Do not include personal identifiable information in

submissions; you should submit only information that you wish to make available publicly. We may redact in part or withhold entirely from publication submitted material that is obscene or subject to copyright protection. All submissions should refer to File Number PCAOB–2023–02 and should be submitted on or before November 7, 2023.

For the Commission, by the Office of the Chief Accountant.¹¹³

Vanessa A. Countryman,

Secretary.

Footnotes

1.   See, e.g., paragraph 08 of AS 1105, Audit Evidence (providing that, in general, “[e]vidence obtained from a knowledgeable source that is independent of the company is more reliable than evidence obtained only from internal company sources”).

2.  Robert H. Montgomery, Auditing Theory and Practice 91 (confirmation of cash deposits), 263 (confirmation of accounts receivable), and 353 (confirmation of demand notes) (1912).

3.  The American Institute of Accountants was the predecessor to the American Institute of CPAs (“AICPA”).

4.   See In the Matter of McKesson & Robbins, Inc., SEC Rel. No. 34–2707 (Dec. 5, 1940).

5.  Shortly after the Board's inception, the Board adopted the existing standards of the AICPA, as in existence on Apr. 16, 2003, as the Board's interim auditing standards. See Establishment of Interim Professional Auditing Standards, PCAOB Rel. No. 2003–006 (Apr. 18, 2003). AU sec. 330 was one of these auditing standards. As of Dec. 31, 2016, the PCAOB reorganized its auditing standards using a topical structure and a single, integrated number system, at which time AU sec. 330 was designated AS 2310. See Reorganization of PCAOB Auditing Standards and Related Amendments to PCAOB Standards and Rules, PCAOB Rel. No. 2015–002 (Mar. 31, 2015).

6.   Concept Release on Possible Revisions to the PCAOB's Standard on Audit Confirmations, PCAOB Rel. No. 2009–002 (Apr. 14, 2009).

7.   Proposed Auditing Standard Related to Confirmation and Related Amendments to PCAOB Standards, PCAOB Rel. No. 2010–003 (July 13, 2010).

8.   Proposed Auditing Standard—The Auditor's Use of Confirmation, and Other Proposed Amendments to PCAOB Standards, PCAOB Rel. No. 2022–009 (Dec. 20, 2022). In this exhibit, the term “proposed standard” refers to the proposed auditing standard relating to the auditor's use of confirmation as described in the 2022 Proposal.

9.  The comment letters received on the 2009 Concept Release, 2010 Proposal, and 2022 Proposal are available in the docket for this rulemaking on the PCAOB's website ( https://pcaobus.org/​Rulemaking/​Pages/​Docket028Comments.aspx).

10.  Under PCAOB standards, financial statement assertions can be classified into the following categories: existence or occurrence, completeness, valuation or allocation, rights and obligations, and presentation and disclosure. See, e.g., AS 1105.11.

11.   See AS 2310.20.

12.   Id.

13.  Situations that involve using audit procedures other than confirmation and situations where companies adopt the policy of responding to electronic confirmation requests from auditors only through an intermediary are discussed later in this exhibit.

14.   See Spotlight: Data and Technology Research Project Update (May 2021), available at https://pcaobus.org/​resources/​staff-publications.

15.   See Spotlight: Observations and Reminders on the Use of a Service Provider in the Confirmation Process (Mar. 2022), available at https://pcaobus.org/​resources/​staff-publications.

16.   See, e.g., In the Matter of Marcum LLP, PCAOB Rel. No. 105–2020–012 (Sept. 24, 2020); In the Matter of Whitley Penn LLP, PCAOB Rel. No. 105–2020–002 (Mar. 24, 2020); In the Matter of PMB Helin Donovan, LLP, PCAOB Rel. No. 105–2019–031 (Dec. 17, 2019); In the Matter of Ronald R. Chadwick, P.C., PCAOB Rel. No. 105–2015–009 (Apr. 28, 2015).

17.   See, e.g., In the Matter of Marcum LLP, PCAOB Rel. No. 105–2020–012 (Sept. 24, 2020); In the Matter of Ronald R. Chadwick, P.C., PCAOB Rel. No. 105–2015–009 (Apr. 28, 2015); In the Matter of Price Waterhouse, Bangalore, PCAOB Rel. No. 105–2011–002 (Apr. 5, 2011).

18.   See, e.g., In the Matter of Whitley Penn LLP, PCAOB Rel. No. 105–2020–002 (Mar. 24, 2020); In the Matter of PMB Helin Donovan, LLP, PCAOB Rel. No. 105–2019–031 (Dec. 17, 2019); In the Matter of Wander Rodrigues Teles, PCAOB Rel. No. 105–2017–007 (Mar. 20, 2017); In the Matter of Ronald R. Chadwick, P.C., PCAOB Rel. No. 105–2015–009 (Apr. 28, 2015); In the Matter of Price Waterhouse, Bangalore, PCAOB Rel. No. 105–2011–002 (Apr. 5, 2011).

19.   See, e.g., In the Matter of Marcum LLP, PCAOB Rel. No. 105–2020–012 (Sept. 24, 2020); In the Matter of Price Waterhouse, Bangalore, PCAOB Rel. No. 105–2011–002 (Apr. 5, 2011).

20.   See, e.g., In the Matter of CohnReznick LLP, SEC Rel. No.34–95066 (June 8, 2022); In the Matter of Ravindranathan Raghunathan, CPA, SEC Rel. No. 34–93133 (Sept. 27, 2021); In the Matter of Mancera, S.C., SEC Rel. No. 34–90699 (Dec. 17, 2020); In the Matter of Schulman Lobel Zand Katzen Williams & Blackman, LLP A/K/A Schulman Lobel LLP, SEC Rel. No. 34–88653 (Apr. 15, 2020); In the Matter of William Joseph Kouser Jr., CPA, SEC Rel. No. 34–80370 (Apr. 4, 2017).

21.   See, e.g., In the Matter of RSM US LLP, SEC Rel. No. 34–95948 (Sept. 30, 2022); In the Matter of Ravindranathan Raghunathan, CPA, SEC Rel. No. 34–93133 (Sept. 27, 2021 ); In the Matter of Winter, Kloman, Moter & Repp, S.C., SEC Rel. No. 34–83168 (May 4, 2018); In the Matter of Edward Richardson, Jr., CPA, SEC Rel. No. 34–80918 (June 14, 2017).

22.   See, e.g., In the Matter of Jason Jianxun Tang, CPA, SEC Rel. No. 34–96347 (Nov. 17, 2022); In the Matter of Steven Kirn, CPA, SEC Rel. No. 34–95949 (Sept. 30, 2022); In the Matter of Friedman LLP, SEC Rel. No. 34–95887 (Sept. 23, 2022); In the Matter of Mancera, S.C., SEC Rel. No. 34–90699 (Dec. 17, 2020); In the Matter of Schulman Lobel Zand Katzen Williams & Blackman, LLP A/K/A Schulman Lobel LLP, SEC Rel. No. 34–88653 (Apr. 15, 2020); In the Matter of Anton & Chia, LLP, SEC Rel. No. 34–87033 (Sept. 20, 2019); In the Matter of Edward Richardson, Jr., CPA, SEC Rel. No. 34–80918 (June 14, 2017); In the Matter of William Joseph Kouser Jr., CPA, SEC Rel. No. 34–80370 (Apr. 4, 2017).

23.  The confirmation process involves obtaining audit evidence from a confirming party. Under PCAOB standards, in general, evidence obtained from a knowledgeable source that is independent from the company is more reliable than evidence obtained only from internal company sources. See, e.g., AS 1105.08.

24.   See, e.g., Staff Audit Practice Alert No. 8, Audit Risks in Certain Emerging Markets (Oct. 3, 2011) (“SAPA No. 8”) at 11 (stating that, when an auditor has identified fraud risks relating to a company's bank accounts or amounts due from customers, “it is important for the auditor to confirm amounts included in the company's financial statements directly with a knowledgeable individual from the bank or customer who is objective and free from bias with respect to the audited entity rather than rely solely on information provided by the company's management”). The requirements of the new standard are consistent with the guidance in SAPA No. 8, which auditors should continue to consider when using confirmations to address fraud risks in emerging markets.

25.   See, e.g., In the Matter of Mancera, S.C., SEC Rel. No. 34–90699 (Dec. 17, 2020) (failure by auditors to properly evaluate confirmation responses to requests for information on cash balances of a Mexican homebuilder subsequently found to have engaged in a “multi-billion dollar financial fraud”). See also Olaf Storbeck, Tabby Kinder, and Stefania Palma, EY failed to check Wirecard bank statements for 3 years, Financial Times (June 26, 2020) (potential failure by auditors to confirm cash balances purportedly held by Wirecard AG, a German company whose securities were not registered with the SEC, directly with a Singapore-based bank).

26.   See, e.g., AS 1105.14 and .18.

27.   See AS 1105.02.

28.  An account or disclosure is a significant account or disclosure if there is a reasonable possibility that the account or disclosure could contain a misstatement that, individually or when aggregated with others, has a material effect on the financial statements, considering the risks of both overstatement and understatement. See footnote 33 of AS 2110, Identifying and Assessing Risks of Material Misstatement; paragraph .A10 of AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements.

29.   See AS 1015, Due Professional Care in the Performance of Work. The Board currently has a separate standard-setting project to reorganize and consolidate a group of interim standards adopted by the Board in Apr. 2003, including AS 1015. See Proposed Auditing Standard—General Responsibilities of the Auditor in Conducting an Audit and Proposed Amendments to PCAOB Standards, PCAOB Rel. No. 2023–001 (Mar. 28, 2023).

30.   See AS 1015.07–.08.

31.  For a discussion of confirmation bias, see, e.g., Raymond S. Nickerson, Confirmation Bias: A Ubiquitous Phenomenon in Many Guises, 2 Review of General Psychology, 175 (1998).

32.   See AS 1105.05.

33.   See AS 1105.08.

34.  AS 2110.59e directs the auditor to identify significant accounts and disclosures and their relevant assertions.

35.   See, e.g., AS 2110 and AS 2301.

36.   See also paragraph .10 of AS 2401, Consideration of Fraud in a Financial Statement Audit (stating that fraud may be concealed through collusion among management, employees, or third parties, and that an auditor may receive a false confirmation from a third party that is in collusion with management); SAPA No. 8 at 12 (stating that, when using confirmation to address fraud risks in emerging markets, “the auditor should evaluate who the intended recipient of the confirmation request is and whether the company's management has an influence over this individual to provide false or misleading information to the auditor” and that “[f]or example, if the company is the only or a significant customer or supplier of the confirming entity, the staff of that entity may be more susceptible to pressure from the company's management to falsify documentation provided to the auditor”).

37.  The term “confirmation process” is defined in paragraph .A3 of the new standard as “[t]he process that involves selecting one of more items to be confirmed, sending a confirmation request directly to a confirming party, evaluating the information received, and addressing nonresponses and incomplete responses to obtain audit evidence about one or more financial statement assertions.”

38.   See Spotlight: Observations and Reminders on the Use of a Service Provider in the Confirmation Process (Mar. 2022), available at https://pcaobus.org/​resources/​staff-publications.

39.  Some intermediaries provide a “bridge letter” or “gap letter” issued by the independent service auditor that addresses the period from the date of the service auditor's SOC report through a subsequent date, typically the most recent calendar year end.

40.   See, e.g., paragraph .05 of AS 1215, Audit Documentation.

41.   See A Firm's System of Quality Control and Other Proposed Amendments to PCAOB Standards, Rules, and Forms, PCAOB Rel. No. 2022–006 (Nov. 18, 2022).

42.   See paragraph .44.j of proposed QC 1000.

43.   See footnote 3 of AS 2310.

44.  AS 2605.12 states that “the internal auditor's work may affect the nature, timing, and extent of the audit,” including “procedures the auditor performs when obtaining an understanding of the entity's internal control (paragraph .13),” “procedures the auditor performs when assessing risk (paragraphs .14 through .16),” and “substantive procedures the auditor performs (paragraph .17).”

45.  AS 2605.27 discusses how the auditor may use internal auditors to provide direct assistance.

46.  Alternative procedures, including the relevant exception described in Appendix C of the new standard, are discussed below.

47.   See AS 1105.09.

48.   See AS 3105.05–.15.

49.   See AS 3105.07.

50.  The information in Figure 1 is intended to be for illustrative purposes and is not a substitute for the new standard; only the new standard provides the auditor with the definitive requirements.

51.   See AS 1105.22.

52.   See, e.g., AS 2110 and AS 2301.

53.   See AS 1105.23 and AS 2301.03.

54.   See, e.g., AS 2301.09.

55.   See, e.g., definition of “cash equivalents” in the Master Glossary of the Financial Accounting Standards Board (“FASB”) Accounting Standards Codification and of “cash equivalents” in the International Financial Reporting Standards (“IFRS”).

56.   See Note to PCAOB Rule 3101(a)(3), which states that “(i)f a Board standard provides that the auditor “should consider” an action or procedure, consideration of the action or procedure is presumptively mandatory, while the action or procedure is not,” and AS 1215.05–.06 (audit documentation should “[d]emonstrate that the engagement complied with the standards of the PCAOB” and must “document the procedures performed . . . with respect to relevant financial statement assertions”). S ee also Audit Documentation and Amendment to Interim Auditing Standards, PCAOB Rel. No. 2004–006 (June 9, 2004), at 3 (“the auditor documents not only the nature, timing, and extent of the work performed, but also the professional judgments made by members of the engagement team and others”).

57.   See, e.g., FASB Accounting Standards Codification Topic 606, Revenue from Contracts with Customers, and IFRS 15, Revenue from Contracts with Customers.

58.   See AS 2310.34.

59.   See AS 1105.08.

60.   See AS 1215.05.

61.   See also Proposed Amendments Related to Aspects of Designing and Performing Audit Procedures that Involve Technology-Assisted Analysis of Information in Electronic Form, PCAOB Rel. No. 2023–004 (June 26, 2023) (proposing amendments to PCAOB auditing standards to specify auditor responsibilities regarding certain company-provided information that the auditor uses as audit evidence, including information that the company received from external sources).

62.   See e.g., AS 1215.05–.06 and AS 1105.07–.08.

63.  The term “audit committee,” as used in the new standard, has the same meaning as defined in Appendix A of AS 1301, Communications with Audit Committees.

64.   See AS 1301.09, .11, .23.

65.  A critical audit matter is defined in AS 3101.A2 as “[a]ny matter arising from the audit of the financial statements that was communicated or required to be communicated to the audit committee and that: (1) relates to accounts or disclosures that are material to the financial statements and (2) involved especially challenging, subjective, or complex auditor judgment.”

66.   See AS 1301.09.

67.   See AS 3101.11–.12.

68.   See AS 2401.67.

69.   See AS 1015.07.

70.   See paragraphs .20 (inability to identify a confirming party), .26 (unreliable response), and .30 (nonresponse or incomplete response) of the proposed standard.

71.  The auditor's evaluation of materiality under AS 2810.17 takes into account both relevant quantitative and qualitative factors.

72.  In certain circumstances, auditors may have obligations independent of the Board's auditing standards to perform either confirmation procedures or other auditing procedures. See, e.g., Section 30(g) of the Investment Company Act of 1940, 15 U.S.C. 80a–29(g) (providing that the auditor's report on the financial statements of a registered investment company “shall state that such independent public accountants have verified securities owned, either by actual examination, or by receipt of a certificate from the custodian, as the Commission may prescribe by rules and regulations”).

73.   See AS 1301.22.

74.   See AS 1301.23.

75.   See AS 3105.05–.17.

76.   See AS 3105.07.

77.   See AS 1105.08.

78.  GNFs are the member firms of the six global accounting firm networks (BDO International Ltd., Deloitte Touche Tohmatsu Ltd., Ernst & Young Global Ltd., Grant Thornton International Ltd., KPMG International Ltd., and PricewaterhouseCoopers International Ltd.).

79.  NAFs are both U.S. and non-U.S. accounting firms registered with the Board that are not GNFs. Some of the NAFs belong to international networks.

80.   See AS 2310.20 for these conditions.

81.   See Spotlight: Observations and Reminders on the Use of a Service Provider in the Confirmation Process (Mar. 2022), available at https://pcaobus.org/​resources/​staff-publications.

82.   Id.

83.   Id.

84.   See Feiqi Huang and Milos A. Vasarhelyi, Applying Robotic Process Automation (RPA) in Auditing: A Framework, 35 Internal Journal of Accounting Information Systems 100433, 100436 (2019).

85.   See Paul Caster, Randal J. Elder, and Diane J. Janvrin, A Summary of Research and Enforcement Release Evidence on Confirmation Use and Effectiveness, 27 Auditing: A Journal of Practice & Theory 253, 254 (2008).

86.   See id. at 253.

87.   See Spotlight: Data and Technology Research Project Update (May 2021), available at https://pcaobus.org/​resources/​staff-publications. See also Spotlight: Observations and Reminders on the Use of a Service Provider in the Confirmation Process (Mar. 2022), available at https://pcaobus.org/​resources/​staff-publications.

88.   See, e.g., Paul Caster, Randal J. Elder, and Diane J. Janvrin, An Exploration of Bank Confirmation Process Automation: A Longitudinal Study, 35 Journal of Information Systems 1, 5 (2021).

89.   See id. at 2.

90.   See Paul Caster, Randal J. Elder, and Diane J. Janvrin, A Summary of Research and Enforcement Release Evidence on Confirmation Use and Effectiveness, 27 Auditing: A Journal of Practice & Theory 253, 261–62 (2008).

91.   See id. at 266.

92.   See L. Ralph Piercy and Howard B. Levy, To Confirm or Not to Confirm-Risk Assessment is the Answer, 91 The CPA Journal 54, 54 (2021).

93.   See Paul Caster, Randal J. Elder, and Diane J. Janvrin, A Summary of Research and Enforcement Release Evidence on Confirmation Use and Effectiveness, 27 Auditing: A Journal of Practice & Theory 253, 254 (2008). The PCAOB staff has also observed that the use of electronic confirmation may affect the confirmation response rate. See Spotlight: Data and Technology Research Project Update (May 2021), available at https://pcaobus.org/​resources/​staff-publications.

94.   See, e.g., Monika Causholli and Robert W. Knechel, An Examination of the Credence Attributes of an Audit, 26 Accounting Horizons 631, 632 (2012): During the audit process, the auditor is responsible for making decisions concerning risk assessment, total effort, labor allocation, and the timing and extent of audit procedures that will be implemented to reduce the residual risk of material misstatements. As a non-expert, the auditee may not be able to judge the appropriateness of such decisions. Moreover, the auditee may not be able to ascertain the extent to which the risk of material misstatement has been reduced even after the audit is completed. Thus, information asymmetry exists between the auditee and the auditor, the benefit of which accrues to the auditor. If such is the case, the auditor may have incentives to: Under-audit, or expend less audit effort than is required to reduce the uncertainty about misstatements in the auditee's financial statements to the level that is appropriate for the auditee.

95.   See Section 301 of the Act, 15 U.S.C. 78f(m). As an additional safeguard, the auditor is also required to be independent of the audit client. See17 CFR 210.2–01.

96.   See, e.g., Joshua Ronen, Corporate Audits and How to Fix Them, 24 Journal of Economic Perspectives 189 (2010).

97.   See id.; see also, e.g., Liesbeth Bruynseels and Eddy Cardinaels, The audit committee: Management watchdog or personal friend of the CEO?, 89 The Accounting Review 113 (2014). Cory Cassell, Linda Myers, Roy Schmardebeck, and Jian Zhou, The Monitoring Effectiveness of Co-Opted Audit Committees, 35 Contemporary Accounting Research 1732 (2018); Nathan Berglund, Michelle Draeger, and Mikhail Sterin, Management's Undue Influence over Audit Committee Members: Evidence from Auditor Reporting and Opinion Shopping, 41 Auditing: A Journal of Practice 49 (2022).

98.   See above for observations from the PCAOB's audit inspections and from SEC enforcement cases.

99.   See also Diane Janvrin, Paul Caster, and Randy Elder, Enforcement Release Evidence on The Audit Confirmation Process: Implications for Standard Setters, 22 Research in Accounting Regulation 1, 10 (2010).

100.   See Spotlight: Observations and Reminders on the Use of a Service Provider in the Confirmation Process (Mar. 2022), available at https://pcaobus.org/​resources/​staff-publications.

101.   See, e.g., Hanwen Chen, Jeff Zeyun Chen, Gerald J. Lobo, and Yanyan Wang, Effects of audit quality on earnings management and cost of equity capital: Evidence from China, 28 Contemporary Accounting Research 892, 921 (2011); Richard Lambert, Christian Leuz, and Robert E. Verrecchia, Accounting Information, Disclosure, and the Cost of Capital, 45 Journal of Accounting Research 385, 410 (2007).

102.  As discussed above, the PCAOB staff's review of firm methodologies indicated that some firms are already confirming cash balances, while other firms' methodologies do not require auditors to perform procedures beyond those required by AS 2310. The growth in corporate cash holdings also highlights the need to confirm cash and cash equivalents. See, e.g., Kevin Amess, Sanjay Banerji, and Athanasios Lampousis, Corporate Cash Holdings: Causes and Consequences, 42 International Review of Financial Analysis 421, 422 (2015).

103.  The Board understands through its oversight activities that few, if any, GNFs use negative confirmation requests as the sole substantive procedure in practice. As discussed above, however, the PCAOB staff's firm methodology review suggests that all the GNFs and NAFs reviewed will need to update their methodologies to ensure that negative confirmation requests are not used as the sole source of audit evidence.

104.   See Yang Bao, Bin Ke, Bin Li, Y. Julia Yu, and Jie Zhang, Detecting Accounting Fraud in Publicly Traded US Firms Using a Machine Learning Approach, 58 Journal of Accounting Research 199, 200 (2020).

105.  One commenter stated that the cost of audit would increase if auditors were required to send confirmations on any and all information that can be confirmed by external parties. While the Board notes that the new standard does not require confirmations on any and all information that can be confirmed, it agrees that companies being audited can incur indirect costs to the extent that auditors pass on at least part of the increased costs in terms of increased audit fees to companies.

106.   See AS 1105.04; AS 2310.33.

107.   SeePublic Law 112–106 (Apr. 5, 2012). Section 103(a)(3)(C) of the Act, as added by Section 104 of the JOBS Act, also provides that any rules of the Board requiring (1) mandatory audit firm rotation or (2) a supplement to the auditor's report in which the auditor would be required to provide additional information about the audit and the financial statements of the issuer (auditor discussion and analysis) shall not apply to an audit of an EGC. The new standard does not fall within either of these two categories.

108.  For the most recent EGC report, see White Paper on Characteristics of Emerging Growth Companies and Their Audit Firms at November 15, 2021 (Jan. 5, 2023) (“EGC White Paper”), available at https://pcaobus.org/​resources/​other-research-projects.

109.  Researchers have developed a number of proxies that are thought to be correlated with information asymmetry, including small issuer size, lower analyst coverage, larger insider holdings, and higher research and development costs. To the extent that EGCs exhibit one or more of these properties, there may be a greater degree of information asymmetry for EGCs than for the broader population of companies, which increases the importance to investors of the external audit to enhance the credibility of management disclosures. See, e.g., Mary E. Barth, Wayne R. Landsman, and Daniel J. Taylor, The JOBS Act and Information Uncertainty in IPO Firms, 92 The Accounting Review 25, 25 (2017); Steven A. Dennis and Ian G. Sharpe, Firm Size Dependence in the Determinants of Bank Term Loan Maturity, 32 Journal of Business Finance and Accounting 31, 59 (2005); Michael J. Brennan and Avanidhar Subrahmanyam, Investment Analysis and Price Formation in Securities Markets, 38 Journal of Financial Economics 361, 363 (1995); David Aboody and Baruch Lev, Information Asymmetry, R&D, and Insider Gains, 55 Journal of Finance 2747, 2755 (2000); Raymond Chiang and P. C. Venkatesh, Insider Holdings and Perceptions of Information Asymmetry: A Note, 43 Journal of Finance 1041, 1047 (1988); Molly Mercer, How Do Investors Assess the Credibility of Management Disclosures?, 18 Accounting Horizons 185, 194 (2004). Furthermore, research has shown that reduced disclosure requirements for EGCs are associated with lower audit effort. The academic literature has also documented evidence of lower audit quality for EGCs. To the extent that the new standard will increase auditor effort, EGCs are expected to benefit from higher audit quality. See, e.g., Tiffany J. Westfall and Thomas C. Omer, The Emerging Growth Company Status on IPO: Auditor Effort, Valuation, and Underpricing, 37 Journal of Accounting and Public Policy 315, 316 (2018); Essam Elshafie, The Impact of Reducing Reporting Requirements on Audit Quality, Auditor Effort and Auditor Conservatism, 35 Accounting Research Journal 756, 756 (2022).

110.  EGC White Paper at 22.

111.  The enhanced quality of audits and financial information available to financial markets may result in investors perceiving less risk in capital markets. This, in turn, may lead to an increase in the supply of capital which could increase capital formation. See, e.g., Hanwen Chen, Jeff Zeyun Chen, Gerald J. Lobo, and Yanyan Wang, Effects of audit quality on earnings management and cost of equity capital: Evidence from China, 28 Contemporary Accounting Research 892, 921 (2011); Richard Lambert, Christian Leuz, and Robert E. Verrecchia, Accounting Information, Disclosure, and the Cost of Capital, 45 Journal of Accounting Research 385, 410 (2007).

112.  For a discussion of how increasing reliable public information about a company can reduce risk premium, see David Easley and Maureen O'Hara, Information and the Cost of Capital, 59 The Journal of Finance 1553, 1578 (2004).

113.  17 CFR 200.30–11(b)(1) and (3).