Document ID: chunk:federal_register_of_legislation:F2021C01273:reg:3:p7
Version: federal_register_of_legislation:F2021C01273
Segment Type: reg
Provision Reference: reg 3 (pt 7/10)
Character Range: 23540–26533

a non-response as set out in paragraphs A18-A19 of this Auditing Standard.  Such procedures also would take account of the results of the auditor's evaluation in paragraph 8(b) of this Auditing Standard.

Results of the External Confirmation Procedures

Reliability of Responses to Confirmation Requests (Ref: Para. 10)

A11.         ASA 500 indicates that even when audit evidence is obtained from sources external to the entity, circumstances may exist that affect its reliability.[16]  All responses carry some risk of interception, alteration or fraud.  Such risk exists regardless of whether a response is obtained in paper form, or by electronic or other medium.  Factors that may indicate doubts about the reliability of a response include that it:

           * Was received by the auditor indirectly; or

           * Appeared not to come from the originally intended confirming party.

A12.         Responses received electronically, for example by facsimile or electronic mail, involve risks as to reliability because proof of origin and authority of the respondent may be difficult to establish, and alterations may be difficult to detect.  A process used by the auditor and the respondent that creates a secure environment for responses received electronically may mitigate these risks.  If the auditor is satisfied that such a process is secure and properly controlled, the reliability of the related responses is enhanced.  An electronic confirmation process might incorporate various techniques for validating the identity of a sender of information in electronic form, for example, through the use of encryption, electronic digital signatures, and procedures to verify web site authenticity.

A13.         If a confirming party uses a third party to coordinate and provide responses to confirmation requests, the auditor may perform procedures to address the risks that:

(a)                The response may not be from the proper source;

(b)                A respondent may not be authorised to respond; and

(c)                The integrity of the transmission may have been compromised.

A14.         The auditor is required by ASA 500 to determine whether to modify or add procedures to resolve doubts over the reliability of information to be used as audit evidence.[17]  The auditor may choose to verify the source and contents of a response to a confirmation request by contacting the confirming party.  For example, when a confirming party responds by electronic mail, the auditor may telephone the confirming party to determine whether the confirming party did, in fact, send the response.  When a response has been returned to the auditor indirectly (for example, because the confirming party incorrectly addressed it to the entity rather than to the auditor), the auditor may request the confirming party to respond in writing directly to the auditor.

A15.         On its own, an oral response to a confirmation request does not meet the definition of an external