White Paper

Confirmation Fraud 

How auditors can overcome 

confirmation fraud challenges
Copyright 2012, Confirmation.com www.confirmation.com

How Auditors Can Overcome Confirmation Fraud Challenges 1

Table of Contents

Introduction 2

An Auditor’s Duties under SAS No. 99 3

Misappropriation of Assets 3

Fraudulent Financial Reporting 4

Nature, Timing and Extent 5

Confirmation Fraud Schemes 5

Client Provides False Contact Information 6

Client Provides the Contact Name 7

Client Influences the Confirmation Process 8

Impracticality of Signature Verification 8

Impact of the Problem 8

Solution 9

Endnotes 11
Copyright 2012, Confirmation.com www.confirmation.com

How Auditors Can Overcome Confirmation Fraud Challenges 2

 Satyam 2008 – 2009

 Take Two 2007 

 Ahold 2005 – 2006

 Kmart 2005 – 2006

 Refco 2004 – 2006 

 Parmalat 2003 

 All First Financial 2002

 HealthSouth 1999 – 2001

 Quintas 1999 – 2001

 Three Points Digital 2000

 Digital Lava 2000

 Logo Athletic 1999

 Converse 1999

 Adidas 1999

 Fila 1999

 Just For Feet 1999

 CF Foods 1999

 North Face 1997 – 1999 

Introduction

It is customary practice for CPAs to use

confirmations as a substantive procedure 

during an audit, but the paper process is

often considered time-consuming because 

the average turnaround takes four – six 

weeks. Yet this process is perceived as a 

relatively low-benefit procedure since it 

requires only routine thought and effort. 

To address this complacency, in January 

2003 the American Institute of Certified 

Public Accountants (AICPA) issued Practice 

Alert No. 03-1 Audit Confirmations to 

emphasize the importance of performing 

confirmations and to highlight the need to 

perform them correctly. This alert was one 

of only three practice alerts published by 

the AICPA within that calendar year. 

In December 2003, just 12 months after the 

practice alert was issued, an approximate 

$5 billion confirmation fraud took place

involving Parmalat, Italy’s largest food 

company. To date this is the world’s largest 

confirmation fraud and Europe’s largest 

financial disaster by any cause. Ironically,

one month before the practice alert was 

released and exactly one year before the $5 

billion Parmalat bank confirmation fraud

occurred, a retired managing partner for a 

Big 4 firm, stated that “The auditing of cash 

is rarely one of the critical audit areas. 

Confirming cash balances is one of the least 

important things to do in an audit.”1 Then 

Parmalat happened. 

Fraudsters with ingenuity identified this 

attitude and neglect, and time and again 

have taken advantage of it to hide their 

frauds and to misrepresent a company’s 

financial statements. Three weeks after the 

Parmalat confirmation scandal broke, a

former auditor with Deloitte said, “What is 

the one line in an audited balance sheet 

that no one questions? Answer: the cash 

and other short-term assets line. And that 

is precisely where this fraud was directed.”2

Accounting firms have now been sued for 

over $10 billion because of the false 

Parmalat bank confirmation, with more 

lawsuits potentially on the horizon from 

those that relied on the audit report.

The Parmalat fraud is the largest cash and 

investment confirmation fraud ever 

discovered, but it is not the only case of 

confirmation fraud used to steal cash or 

falsify financial reports. Here is just a 

sampling of some of the more significant 

public and private company confirmation 

frauds from recent years:
Copyright 2012, Confirmation.com www.confirmation.com

How Auditors Can Overcome Confirmation Fraud Challenges 3

An Auditor’s Duties Under SAS No. 99

The overriding theme throughout SAS No. 99 is the 

auditor’s obligation to exercise professional skepticism. 

SAS No. 99 requires an auditor (1) to hold a brainstorming

session to identify and assess the risks of material 

misstatement due to fraud and (2) to respond to those 

identified fraud risks in a way that effects how the audit is 

conducted and is reflected in the nature, timing and extent 

of the auditing procedures performed. Figure 1 shows The 

Fraud Risks Assessment Process.3

SAS No. 99 defines two types of fraudulent misstatements 

that are relevant for the auditor to consider – misstatements arising from fraudulent financial 

reporting and misstatements arising from the misappropriation of assets.

This paper identifies confirmation fraud as a significant fraud risk that falls into both categories 

of fraudulent misstatements that every auditor must now respond to as they perform their 

duties under SAS No. 99 and offers solutions for the auditor to incorporate into the audit 

program.

Misappropriation of Assets

Misappropriation of assets is also referred to as theft or defalcation and involves the theft of an 

entity’s assets. Misappropriation of assets accounts for 92.7 percent of all occupational frauds.4 

In applying SAS No. 99 to an audit, the auditor must determine what assets are most likely to be 

targeted for theft. While performing this assessment the auditor must also consider the 

“inherent risk” of fraud at the individual account and transaction level. 

Now that it is publicly available, the auditor should utilize and incorporate the findings from The 

Association of Certified Fraud Examiners’ (ACFE) 2004 Report to the Nation on Occupational 

Fraud and Abuse into the audit. In specifically looking at frauds involving the misappropriation 

of assets, the ACFE identified that cash is the targeted asset 93.4 percent of the time. This is an 

increase from the ACFE’s 2002 Report which found that cash was the targeted asset in 90.1 

percent of the cases studied.

 

5

93.4%

22.1%

0.0% 10.0% 20.0% 30.0% 40.0% 50.0% 60.0% 70.0% 80.0% 90.0% 100.0%

Cash ($98,000)

Non-Cash ($100,000)

Breakdown of Asset Misappropriations 

Figure 1

Figure 2
Copyright 2012, Confirmation.com www.confirmation.com

How Auditors Can Overcome Confirmation Fraud Challenges 4

As the auditor assesses the risks of fraud related to the misappropriation of assets, cash fraud 

should be a primary focus during the brainstorming session. SAS No. 31 states that “When 

evidential matter can be obtained from independent sources outside an entity, it provides 

greater assurance of reliability for the purposes of an independent audit than that secured 

solely within the entity,”6and therefore properly confirming cash balances becomes an 

excellent audit procedure when auditing cash and investment accounts.

Even though some auditors may believe their client would never commit fraud, or that only the 

largest public companies are susceptible to fraud, SAS No. 99 demands that auditors recognize 

that fraud may exist in every audit and this supposition is supported by the ACFE’s Report that 

found fraud occurs in companies of all sizes and is perpetrated by low-level employees and top 

executives. The study actually revealed that “Small businesses suffer disproportionately large 

losses due to occupational fraud and abuse.”

Confirmation fraud schemes are not restricted to public or private, or large or small companies. 

Large, high dollar public company frauds make the headlines, but the ACFE study found that 

public companies only represented 30 percent of the fraud cases that were studied and that 

the median loss due to fraud for private companies was 23 percent higher than the median loss 

due to fraud for public companies. 

7

Because audit fees are typically higher for public company audits than for private company 

audits, the 23 percent higher median loss for a private company fraud may indicate that private 

company audits have more risk associated with each revenue dollar than public company 

audits. 

Fraudulent Financial Reporting – Presumption of Revenue Recognition Fraud Risk

Fraudulent financial reporting involves the intentional misstatement of financial statements in 

order to deceive the users of those financial statements. SAS No. 99 states that management is 

in the best position to perpetrate a fraud, and that auditors must presume that there is a 

material risk of fraud related to revenue recognition for all audits. Unlike many audits where 

materiality is determined to be a specific dollar threshold, the SEC’s Staff Accounting Bulletin 99 

states that a small dollar amount can be material if it accomplishes something significant such 

41.8%

30.3%

15.8%

4.5%

0% 5% 10% 15% 20% 25% 30% 35% 40% 45%

Private Company ($123,000)

Public Company ($100,000)

Government ($37,500)

Not-for-Profit Organization ($100,000)

Organization Type of Fraud Victims

Figure 3
Copyright 2012, Confirmation.com www.confirmation.com

How Auditors Can Overcome Confirmation Fraud Challenges 5

as getting a bank loan approved or meeting projections to achieve a certain stock price or to 

qualify for a bonus.

A company booking entries to fraudulently increase revenue, could book the opposing journal 

entry to either cash or accounts receivable. Using third-party confirmations to validate the 

status of these accounts will help the auditor 

determine if the revenue is real or was fraudulently 

booked by management. 

Over an estimated ten-year period, Parmalat grew 

its fictitious cash account to almost $5 billion to sell 

public debt and qualify for commercial lines of 

credit. Some of the off-setting entries to the 

erroneous booked cash and investment accounts 

may have been to the revenue account.

According to the complaint filed by the Securities 

and Exchange Commission, HealthSouth used its 

auditing firm’s own processes against it to 

perpetrate financial statement fraud. HealthSouth 

executives knew that the auditing firm did not 

question fixed-asset additions below a certain 

dollar threshold (materiality), so it made random 

entries to its balance-sheet accounts for fictitious assets worth less than the known materiality 

amount. HealthSouth’s senior accounting personnel then created false documents to support 

cash accounts that were overstated by a combined total of $300 million. This overstatement 

represented 20 percent of the originally identified $1.5 billion fraud.

Nature, Timing and Extent

SAS No. 99 requires auditors to adjust the nature, timing and extent of their audit procedures in 

response to identified audit fraud risks. For confirmation procedures, this should include 

performing confirmations at other than year-end times and confirming balances and 

information at dates other than just the fiscal year-end date. As well, auditors should increase 

the sample sizes for confirmations, and may want to confirm 100 percent of all the accounts 

instead of just a sample. With four – six week turnaround times, this may be impractical when 

using paper-based confirmations. As well, paper-based confirmation procedures come with 

their own set of fraud risks.

Confirmation Fraud Schemes

Third-party bank confirmations are, by definition, sent to a client’s bank and therefore, CPAs 

must remember that the ultimate exposure to confirmation fraud lies within the identity of the 

“responder.” The CPA must determine that the respondent is both legitimate and free from 

bias. 

“The most common way 

companies create fictitious 

revenues is to dummy up sales 

that did not occur. The 

accounting transaction created 

is a credit to sales with an 

offsetting debit to accounts 

receivable, which boosts both 

assets and income.”

- Joseph T. Wells, CPA, CFE

Founder and Chairman of the 

Association of Certified Fraud 

Examiners

Journal of Accountancy Oct. 2000
Copyright 2012, Confirmation.com www.confirmation.com

How Auditors Can Overcome Confirmation Fraud Challenges 6

Providing false statements and documents, like HealthSouth employees did to their auditors, is 

only the first step in a confirmation fraud scheme. The second step is accomplished by 

providing a false response to a confirmation request either through impersonating the 

responder or conspiring with the responder as to how they should “confirm” information to 

auditors.

SAS No. 67 specifically focuses on the confirmation process and outlines the four tenants of 

performing a “proper” confirmation. They are:

1. Direct communication with the third party

2. Professional skepticism

3. Respondent free from bias

4. Maintaining control

Unfortunately, many auditors fail to follow the proper confirmation procedures and simply 

believe that receiving a signed response to a confirmation request provides them the proper 

audit evidence needed for the audit. The following fraud schemes identify the fallacy in this 

belief and serve as notice to the auditor who 

does not properly put in place confirmation 

procedures that follow the four tenants of SAS 

No. 67 that they are not following SAS No. 99’s 

directive to exercise a heightened level of 

professional skepticism.

1. Client Provides False Contact Information 

In a survey of over 150 accounting firms (without 

regard to sizes of the firms) researchers 

discovered that the mailing addresses for 

confirmations are being provided to the auditor 

by the client or taken directly off the clientprovided bank statements (already in the client’s 

possession). In one case, the auditor called the 

toll-free number on the client’s bank statement 

in an honorable attempt to validate the mailing 

address for the confirmation. However, the risk associated with any client-provided 

documentation is that a dishonest client attempting to thwart the confirmation process can 

easily “scan” data and produce fake statements, including names, addresses and phone 

numbers. 

The 2004 Wall Street Journal cover story reported that this was exactly what happened with 

SafeScript’s $2.5 million of missing cash, “(Management) accomplished this deception by 

cutting, pasting and supplementing genuine bank statements, and then copying the carefully 

altered final product.”8 CPAs should never confuse the obtaining of evidence with the 

attainment of proof. Data, from any source, may be evidence, but is not necessarily proof. 

“The auditor should consider 

whether there is sufficient basis 

for concluding that a confirmation 

request is being sent to a valid 

respondent from whom a 

response will be meaningful and 

provide competent evidential 

matter. If there is not a sufficient 

basis for that conclusion, the 

confirmation process is useless.”

- Doug Carmichael

 “Pitfalls of the Confirmation Process”
Copyright 2012, Confirmation.com www.confirmation.com

How Auditors Can Overcome Confirmation Fraud Challenges 7

Sufficient, competent objective evidence must be professionally and properly subjected to 

audit.

During the PCAOB’s June 2004 Standing Advisory Group meeting in Washington D.C.,9Jeff 

Steinhoff, the Managing Director of Financial Management & Assurance for the U.S. General 

Accounting Office answered the self posed question of “what do you want to achieve here” as it 

relates to the confirmation process. He answered:

“I think you want sufficient audit evidence, that whether 

it be cash, receivables or whatever it is, that the entity 

you are auditing has those numbers. It is not solely to 

get the piece of paper that’s got the number on it. It’s 

to provide some information that when put together 

with other information, such as side letter agreements 

or whatever it is, someone would make a determination 

that they had sufficient audit evidence to accept that 

balance.”

He continued by saying that in the review of an auditors 

work if:

“(T)here was no process and no attempt by the auditor 

(to meet the objectives of the confirmation process), or 

it was merely just getting a piece of paper that 

confirmed a number and sticking it in the working papers then you might make a 

determination that that audit did not meet the objective of what you are looking at. 

When the General Accounting Office has looked at failed audits, (they) failed because 

they (the auditors) have done very little or they’ve found a way to ‘paper over’ the 

process by sticking a management representation or a couple of confirmation type 

documents in an audit file.”

2. Client Provides the Contact Name

Auditors do not inherently know the proper parties that should or may sign the requested 

confirmation responses and there is very little the auditor can do to validate a signature. A 

client may direct the auditor to send confirmations to a dishonest confederate who will 

fraudulently complete the confirmation responses and sign the name of another employee or a 

fake name, in hoping to avoid detection.

Wayne Kolins, the National Director of Assurance for BDO Seidman stated at the PCAOB’s June 

2004 Standing Advisory Group meeting10 that:

“I think the biggest problem that I see with confirmations is ‘who’ on the other side is 

actually signing the confirmations? Are they sufficiently knowledgeable? And is the 

auditor even thinking about that when he or she receives the confirmation? This is one 

of the most significant pieces of evidentiary matter that the auditors have (an audit 

confirmation) and to the extent that that is diluted is a significant detriment to the audit 

process.”

“Auditing firms are not only 

risking their reputation, but 

also their survival if they 

don’t make finding fraud 

the central goal of their 

auditing services.”

- Michael P. Glynn, October 4, 

2004

Technical Manager of the 

AICPA’s Audit & Attest 

Standards
Copyright 2012, Confirmation.com www.confirmation.com

How Auditors Can Overcome Confirmation Fraud Challenges 8

3. Client Influences the Confirmation Process

Numerous case studies illustrate how dishonest clients succeed at influencing an auditor's 

confirmation procedures. If a client knows that the auditor may attempt to authenticate the 

client provided fake contact information, with a little effort and a few dollars the fraudster can 

create third-party credentials which closely resemble legitimate credentials.

For example, an inexpensive “fake” website (built for under $300), displayed as if it were for a 

legitimate financial institution, can be created to provide incorrect contact information, 

including email addresses, telephone and FAX numbers, and fake mailing addresses. Fraudsters 

might purchase a website address, also known as a URL, similar to the legitimate company’s 

website, paying an Internet Service Provider (ISP) to host the website, and then simply copy and 

paste the source code from the original site into the fraudulent site while changing only the 

contact information. 

In some cases, not only is the fraudulent website almost an exact replica of the original and 

valid website, the website and email extension appear to be legitimate to those who do not 

have a day-to-day working relationship with that specific financial institution.

4. Impracticality of Signature Verification

Given all the possible loopholes that exist, which may allow circumvention of the paper 

confirmation process, auditors may lack the available resources needed to validate the 

legitimate signatures on responses to confirmation requests. 

Fraudsters falsely responding to a confirmation request may simply scribble the signature of 

anyone to create the appearance of effective validity. 

Impact of the Problem

Due to the ease of circumventing the paper confirmation process for fraudulent purposes and 

the inefficiency inherent in the paper confirmation process, auditors are (1) not identifying the 

confirmation fraud schemes employed and are (2) deficient in the resources necessary to 

authenticate the confirmation responses and therefore are (3) instead “papering-over” the 

objective of obtaining “sufficient audit evidence.”

When utilizing confirmations as an audit procedure and by relying on the responses as audit 

evidence, under SAS No. 99, the professional auditor must respond to the above identified risks 

of confirmation fraud. Merely being mentioned as a party to a fraud case can have a careerdamaging effect. The financial consequences of being involved in a lawsuit or criminal 

investigation may be substantial. Juries are not very forgiving when a fraud, or even a potential 

fraud, goes undiscovered by auditors, regardless of how immaterial the effect on the financial 

statements taken as a whole. Auditors must realize that:

“Malpractice cases are litigated with 20/20 hindsight, with all the facts out for the world 

to see. If you don’t pursue the red flags of fraud – even those not listed in SAS 99 – you 

likely will be held liable for resulting losses.”

11
Copyright 2012, Confirmation.com www.confirmation.com

How Auditors Can Overcome Confirmation Fraud Challenges 9

Solution

Secure electronic confirmation solutions, like the one offered by Capital Confirmation, Inc. 

streamline the confirmation process by replacing the paper-based confirmation process with 

secure electronic confirmation processes. This solution provides authentication and 

authorization procedures that not only help CPA firms detect fraud but also serve as a deterrent 

to fraudsters hoping to circumvent the audit confirmation process. This is accomplished 

through the secure online network maintained by an independent third-party where all the 

responders to confirmations are validated before they can respond to an auditor’s confirmation 

request.

In addition to the fraud detection and 

prevention capabilities that electronic 

confirmation solutions provide, the chart in 

Figure 4, made available by Capital 

Confirmation, illustrates how electronic 

confirmation solutions are much more 

efficient compared to mailing paper 

confirmations. Where auditors often 

experience lengthy turnaround times and 

often never even receive a mailed confirmation back, the highlights of electronic confirmations 

include a 100 percent response rate, an average turnaround of 1.12 days and the fact that 99.5 

percent of all electronic confirmations are returned in five days. The mailed paper confirmation 

statistics do not even come close to those response rates, and with mailed paper confirmations 

there is no inherent fraud protection provided.

Secure electronic confirmation solutions provide the following core capabilities:

 Multiple layers of authentication and security to validate the authenticity of responders;

 Web-based interface for performing audit confirmations; and

 A record of activity on every confirmation that provides a traceable path of 

accountability to each individual involved in the confirmation process.

Additionally, because the average response time for electronically sent confirmations is about 

one day, auditors can now respond to confirmation fraud risk by altering the nature, timing and 

extent of their confirmation procedures in accordance with the SAS No. 99 directives and:

 Perform confirmations throughout the fiscal year; and

 Confirm larger sample sizes to include confirming 100 percent of the accounts.

Electronic 

Confirms

Paper* 

(Mailed)

Response Rate 100% 70%

Reconfirmation Rate 5.6% 35.0%

Ave. Turnaround (days) 1.12 21.00

Min. Turnaround (minutes) 3 min. 7,200 min.

Max. Turnaround (days) 10.69 56.00

% Turned in 2 days 94.5% 0%

% Turned in 3 days 97.0% 0%

% Turned in 5 days 99.5% < 1%

* Based on feedback from survey of selected CPA firms.

Figure 4
Copyright 2012, Confirmation.com www.confirmation.com

How Auditors Can Overcome Confirmation Fraud Challenges 10

In a paper by the leading researchers and authors on continuous auditing, the authors 

summarize the benefits of electronic confirmations by asserting that:

“The usage of automatic confirmations will substantially change the nature, procedures, 

scope, and weight attributed to audit evidence. Confirmations, obtained automatically, 

and highly complemented by self-correcting procedures will eventually be the most 

important form of audit evidence. Automatic confirmations... will substantively resolve 

the audit objectives of existence, completeness, and to a certain degree accuracy at the 

transaction level and account aggregation levels.”12

For more information about secure electronic confirmations, contact us at: 

1-888-716-3577 or visit www.confirmation.com.

Capital Confirmation, Inc.

214 Centerview Drive, Suite 265

Brentwood, TN 37027

Phone: 888-716-3577
Copyright 2012, Confirmation.com www.confirmation.com

How Auditors Can Overcome Confirmation Fraud Challenges 11

Endnotes

 

1

Gethan Ward, “Brentwood Company Develops Application to Electronically Confirm Bank Account Balances,” The 

Tennessean, December 17, 2002.

2

 “Parma Splat: What are the lesions from the scandal at Europe’s largest dairy-products group?,” The Economist, 

January 15, 2004.

3

 Michael Ramos, “Auditors’ Responsibility for Fraud Detection,” Journal of Accountancy, January 2003.

4

Association of Certified Fraud Examiners (ACFE), “2004 Report to the Nation on Occupational Fraud and Abuse,” 

(2004), 12.

5

ACFE, 13.

6

 SAS No. 31, Evidential Matter (AU sec. 326).

7

ACFE, 5.

8

 “Trying to Copy Celebrity Stock-Pickers,” Wall Street Journal, October 15, 2004, Section A1.

9

 PCAOB Standing Advisory Group Meeting, June 21, 2004, afternoon session 1, timeslot 1:52:00/2:18:53. 

http://www.connectlive.com/events/pcaob.

10 PCAOB Standing Advisory Group Meeting, June 21, 2004.

11 Gary D. Zeune, “SAS 99 – Friend or Foe? How not to get sued under the new fraud auditing standard,” 

(www.cpamutual.com)

12 Vasarhelyi, Alles, Kogan, “Principles of Analytic Monitoring for Continued Audits,” July 2003.