To make the external confirmation process more efficient and effective, auditors and banks have been increasingly relying on new technologies to facilitate the bank confirmation process. ASA 505 does not preclude the use of an electronic confirmation process or the acceptance of electronic confirmations as audit evidence.

Electronic confirmations in the context of this Guidance Statement, refers to the auditor using a technological resource which automates the entire, or part of, the confirmation process. Examples of these technologies include, service providers who establish a secure platform through which the confirming party and auditor communicate directly, or other technological resource which directly interfaces with the confirming party’s systems such as an Application Programming Interface (API).

Email and facsimile are largely paper-based confirmation processes using technology, they have been excluded from electronic confirmations in the context of this Guidance Statement and are captured under paper-based confirmations.

When an electronic confirmation process is used, the auditor may be relying on the processes and controls of an external party or the firm to maintain control over the external confirmation process.

The procedures the auditor performs to maintain control over the confirmation process may be dependent on whether the electronic confirmation resource is a technological resource that has been approved for use by the firm. Where the technological resource is not approved for use by the firm, additional procedures may need to be performed to evidence that the auditor has maintained control over the confirmation process.

Electronic Confirmation Resources Approved by the Firm

An electronic confirmation resource whether developed or obtained by the firm, or from a service provider, is a technological resource that is used directly by the engagement team in the performance of the engagement. Where the auditor is using an electronic confirmation resource approved for use by the firm, the firm, in accordance with the quality objective of ASQM 1^[11], has been through a quality management process so that the technological resource is appropriate for the use in the performance of engagements.

When making a technological resource available to engagement teams^[12], a firm may consider a number of matters including:

1. The technological resource operates as designed and achieves the purpose for which it is intended;
2. Confidentiality of the data is preserved;
3. The need to develop procedures that set out how the technological resource operates.

Where the technological resource made available to the engagement team for use in the performance of engagements comes from a service provider^[13], there are further considerations that the firm may consider, including:

1. The nature and scope of the use of the technological resource;
2. The extent to which the technological resource is used;
3. How the service provider intends to maintain the technological resources.

In meeting the quality objective that appropriate technological resources are used in the performance of engagements, the firm may consider obtaining control reports^[14] for the technological resource and reviewing areas that address relevant areas to maintaining control of the confirmation process.

Where a report is expected to be used as audit evidence, the requirements of ASA 402^[15] may provide an appropriate framework for the firm’s evaluation of the appropriateness of the resource.

Once a firm considers that the technological resource is appropriate for use in the performance of engagements, the firm may monitor for changes in the environment since the report was issued and consider whether those changes in the environment would impact on the firm’s ability to rely on the report.

Where a report is not able to be provided or is not sufficiently reliable for the intended purpose, as an alternative the firm may perform direct testing of the design and operating effectiveness of the technological resource’s relevant controls.

Once the technological resource is approved by the firm, the firm may establish policies and procedures for the engagement team’s use of the technological resource. For example the firm may have a policy limiting use to specifically approved personnel, or have a policy that only resources on a firm approved list can be used.

The Engagement Partner’s Responsibility where the Technological Resource is Approved by the Firm

ASA 220 Quality Management for an Audit of a Financial Report and Other Historical Financial Information addresses the engagement partner’s responsibility to use the resources provided by the firm, including technological resources.^[16]

When using technological resources approved by the firm, the engagement partner is ordinarily able to rely on the firm’s policies and procedures to approve that resource for use. To be able to rely on the firm’s approval of the resource, the engagement team follows the firm’s policies and procedures around the use of the technological resource, including whether specialist expertise is required and remains alert for any information throughout the engagement that may indicate that the firm’s policies and procedures related to the resource are not operating effectively.

The Engagement Partner’s Responsibility where the Technological Resource is Not Approved by the Firm

Not all technological resources used by the engagement team in the performance of an engagement will be a resource approved by the firm. Where a technological resource is used in the confirmation process and it is not approved by the firm, the engagement partner is responsible for performing procedures to obtain sufficient appropriate evidence that the technological resource is appropriate for use in the circumstances.

The engagement team may perform procedures based on paragraphs 28-34.