# Bank Confirmation Request: Sending and Reading Replies

- Author: PreciseBankFlow (https://precisebankflow.com)
- Published: 2026-10-17
- Category: Bank statements in an audit
- Canonical: https://precisebankflow.com/blog/bank-confirmation-request

> How to send a bank confirmation request, electronic versus paper, what the reply covers, and what to do when it disagrees with the client's records.
A bank confirmation request asks the client's bank to report, directly to the auditor, the balances, loans and other arrangements it holds for the client at the period end. The auditor prepares and sends it, the bank replies to the auditor, and every figure in the reply is then agreed to the client's reconciliation and ledger.

## What does a bank confirmation request ask the bank to state?

A bank confirmation request asks for the facts the bank alone can vouch for: each deposit account and its balance at the confirmation date, any loans or lines of credit with their balances and terms, and arrangements such as guarantees or compensating balances. The auditor fills in what the client's records show and the bank confirms or corrects it.

### Deposit balances

The first block of any request covers deposit accounts. For each one, the request names the account, gives the account number and states the balance the client recorded at the date. The bank is asked to agree that balance or supply the right one. Ask also that the bank list any account in the client's name that the request did not mention. That open question is often where a forgotten account turns up, such as a dormant savings account or a deposit account opened for a single project.

### Borrowings and other arrangements

The second block covers what the client owes the bank or has pledged to it. That means term loans, lines of credit, letters of credit and any security the bank holds. Interest rates, maturity dates and collateral belong here too, because they feed the debt disclosure as well as the cash balance. A balance that the bank holds back as security for a loan is cash the client cannot freely spend, which matters for classification.

### What the request should leave out

The request should not ask the bank to confirm things it does not keep, such as the client's book balance or reconciling items. The bank knows its own ledger. Asking it to comment on the client's ledger slows the reply and adds nothing.

## Electronic versus paper bank confirmation requests

Electronic and paper requests ask the same questions; they differ in how the request travels and how much the auditor can trust the route. An electronic request through a confirmation platform goes straight to a verified contact at the bank. A paper request depends on a correct postal address and on the reply coming back without passing through anyone else.

### When to use an electronic platform

Many banks now answer through an electronic confirmation service. A platform shortens turnaround and records who sent and who answered. The trade-off is that the auditor relies on the platform's own controls. The PCAOB addressed this directly in its updated standard: the [PCAOB's 2023 AS 2310 confirmation standard, as filed with the SEC and published in the Federal Register](https://www.govinfo.gov/content/pkg/FR-2023-10-17/html/2023-22491.htm), says an intermediary should not be used when the auditor has information that its controls over interception or alteration are not in place or not working. Read the platform's controls report, or the firm's evaluation of it, before relying on the reply.

### When paper still makes sense

Paper is still the practical choice for a small community bank, a credit union or a foreign bank that is not on any platform. Address the request to the bank, not to a named relationship manager the client suggested, and check the address against the bank's own published details rather than the client's list. Send it in the firm's envelope, with a return address that reaches the audit team.

### Email requests

A request sent by plain email sits between the two. It is fast, but the auditor has to confirm that the email address really belongs to the bank and that the reply came from the bank's domain. Keep the full email header with the response in the file.

## Keeping control of the bank confirmation request and reply

Control of a bank confirmation request means the auditor chooses what to confirm, sends the request and receives the answer, with the client acting only as signatory. The client signs an authorization letter so the bank can release the information, but the client never handles the completed request on its way out or the reply on its way back.

The PCAOB's 2023 AS 2310 filing says it plainly: the auditor should select the items, send the requests and receive the responses, and a response that did not come straight from the confirming party counts as a nonresponse. That second point is easy to miss. A reply the client forwards, or a PDF the client downloads from online banking and emails to you, is not a confirmation, however genuine it looks.

Practical steps that keep control:

1. Get the client's signed authorization first, then prepare the request yourself from the trial balance and the bank statements.
2. Check the bank's contact details independently.
3. Send the request from the firm, and log the date sent.
4. Have replies come to a firm address or platform account, never to the client.
5. Note the date each reply arrives and who on the team opened it.
6. If the client offers to chase the bank, let them phone, but keep the reply route unchanged.

## Reading the bank's confirmation reply line by line

Read the reply as a list of facts to agree, one at a time, to the client's records. The deposit balance goes to the bank side of the reconciliation at the same date. Loan balances go to the debt schedule. Any account the client did not list goes straight to a manager.

An unlisted account matters because it means total cash may be incomplete.

The table below is a worked example. The bank, accounts and amounts are invented for illustration.

| Item in the reply | Bank says | Client records say | Difference | Follow-up |
| --- | --- | --- | --- | --- |
| Operating checking, ending 2210 | 184,306.12 | 184,306.12 per reconciliation, bank side | None | Agree to reconciliation, tick |
| Payroll account, ending 2238 | 3,040.00 | 3,040.00 | None | Agree to reconciliation, tick |
| Savings, ending 7781 | 52,118.40 | Not on the client's list | Account missing | Ask client, add to the cash lead, reconcile it |
| Line of credit | 250,000.00 drawn | 200,000.00 per debt schedule | 50,000.00 | Find the draw, check the loan entry and its date |
| Collateral | Savings ending 7781 pledged | No mention | Disclosure gap | Assess restriction and classification |

Two of those rows look clean and three need work. The missing savings account matters most, because it changes total cash and suggests the client's account list was built from memory. The line of credit difference may be a draw recorded after year end. The pledge means part of the cash is not free to use, which affects how it is presented.

### Matching the reply to the statements

The confirmed deposit balance should equal the closing balance on the bank statement for the same date. If the reply and the statement disagree, one of them is wrong, and it is usually the statement the client provided. The reply came straight from the bank; the statement passed through the client's hands. A useful next step is to rebuild the period's activity in a [four-column proof of cash](/blog/proof-of-cash), which shows whether receipts and disbursements, not just the closing figure, agree.

## What if the bank confirmation reply disagrees with the client's records?

A difference between the bank's reply and the client's records is a confirmation exception, and each one needs an explanation backed by evidence before you move on. Most exceptions are timing differences or clerical errors. A few point to an unrecorded account, an unrecorded loan or an altered statement, so none can be cleared by assumption.

The PCAOB's 2023 AS 2310 filing defines a confirmation exception as any case where the reply differs from information the auditor got from the company. That definition is deliberately broad. It covers a balance that is off by a cent, an account the client never mentioned and a loan term that differs from the debt agreement.

### Working an exception

Start with the simplest explanation and prove it with documents:

- **Timing.** The bank may report the balance at a slightly different date or time of day. Ask the bank which cutoff it used and compare it with the statement.
- **Recording error.** The client may have keyed a balance wrongly into the reconciliation. Agree the figure to the statement and the ledger.
- **Unrecorded items.** A loan draw, fee or transfer may sit in the bank's records but not the client's. Trace it to the bank activity and to a journal entry.
- **Something worse.** If none of those explains it, consider whether the client's statement was altered or an account was hidden. Get statements straight from the bank.

The statement for the days after year end is often the fastest way to settle a timing question. The [guide to the cutoff bank statement](/blog/cutoff-bank-statement) covers how to request one from the bank and what to look for in it.

### Duplicates and gaps in the activity

When the difference comes from the activity rather than the closing figure, check the statement lines themselves. A deposit recorded twice in the books, or a debit missing from the client's statement copy, produces exactly this kind of gap. [Finding duplicate and missing transactions on bank statement lines](/blog/finding-duplicate-transactions-on-bank-statement-lines) shows how to locate the line responsible. PreciseBankFlow foots each statement and flags possible duplicates and check number gaps, which narrows the search before you ask the client a question. The judgment on the exception stays with the auditor.

## Bank confirmation requests that never come back

A bank confirmation request with no reply is a nonresponse, and the evidence it was meant to provide is still missing. Send a second request, phone the bank to confirm the address and contact, and give it a deadline. If the bank still does not answer, perform alternative procedures and document why they give enough evidence.

### Alternative procedures for cash

For a deposit account, alternative evidence usually means statements obtained directly from the bank, a review of the account online with the client present and the auditor in control of the screen, and testing activity after the period end. None of these is quite as strong as a reply to the auditor, so weigh them against the size and risk of the account. A small petty cash account at a local bank can be covered this way. The main operating account of a client with a fraud risk usually cannot.

### Nonresponses that signal a problem

Sometimes silence is the finding. A bank that cannot locate the account, a reply that arrives from an address that is not the bank's, or a client who insists on handling the request are all reasons to slow down. Record each attempt, the date and the outcome. If the client resists the request outright, discuss it with the engagement partner before you accept another form of evidence.

### Confirmations outside a financial statement audit

Confirmation requests also appear in forensic work, such as a divorce or partnership dispute, where the question is which accounts exist and whose money sits in them. There the request is often replaced or backed up by a subpoena. Once the accounts are known, the harder job is following funds between them; [tracing separate property through commingled accounts](/blog/tracing-separate-property) covers that method.

If you want the footing and exception checks done on the client's statements before the replies arrive, [PreciseBankFlow](/get-started) is opening to audit firms in small groups.