What Is Negative Confirmation? Audit Confirmations Explained

External confirmations come in two flavours. A positive confirmation asks the third party to confirm agreement or fill in the correct amount — a reply is required either way, and non-response is followed up with alternative procedures. A negative confirmation asks for a reply only on disagreement: 'Our records show you owe AED 1,240 as at 31 December. Please reply only if this is incorrect.' No reply = presumed agreement.

The evidential difference is stark. A positive confirmation response is strong, direct evidence of existence and accuracy. A negative confirmation's silence is weak evidence — it shows only that no one objected, which could mean agreement, apathy, a wrong address, or a recipient who never opened the letter. ISA 505 therefore restricts negative confirmations to situations where the auditor already has good reason to believe the risk is low.

The three ISA 505 conditions: (1) the assessed risk of material misstatement is low; (2) the population comprises a large number of small, homogeneous balances; and (3) a very low exception rate is expected, with a basis for believing recipients will give the requests adequate consideration. Miss any condition and negative confirmations are inappropriate — the auditor must use positives or other procedures.

Design starts with the population: thousands of small balances with similar characteristics — utility customers, subscription receivables, small trade debtors in a cash-and-carry business. The request states the balance clearly, gives a reply mechanism (prepaid envelope, email, portal), sets a response deadline, and — critically — asks for disagreement only. Some designs add a twist: the 'blank' negative, stating no amount and asking for correction if records differ (rare; weaker still).

On return, exceptions (disagreements) are investigated fully — each one is evidence of misstatement, and the auditor considers whether the exception rate implies the population assumption was wrong. Non-responses require no follow-up under the negative model (that is the point), but the auditor must remain alert: if the response channel itself looks compromised (bounced emails, wrong addresses at scale), the basis for relying on silence collapses.

Evaluation: the auditor concludes whether the negative confirmations, combined with other evidence, provide sufficient appropriate evidence. ISA 505 is explicit that negatives alone rarely suffice — they are a supplement to tests of details or analytics, not a standalone basis. Documentation records the population analysis, the three conditions' assessment, the request design, exceptions and their disposition, and the overall conclusion. Where exceptions exceed expectations, the auditor re-evaluates — often switching the remaining population to positive confirmations.

UAE practice constrains negative confirmations more than the standard does. Response culture is the issue: confirmation reply rates in the UAE are modest even for positive requests (many businesses ignore auditor letters), which undermines the 'recipients will consider the request' condition. Auditors therefore default to positive confirmations for material balances and use negatives only for genuinely low-risk, high-volume populations.

Where UAE auditors do use them: healthcare patient receivables (hundreds of small balances), education fee receivables, retail/subscription customer balances, and utility-style billings. Even there, firms often upgrade to positives for the larger balances within the population — a hybrid approach ISA 505 permits.

Two UAE-specific wrinkles. Email confirmations dominate (postal is unreliable); the auditor must control the process — sending from the auditor's domain to independently verified addresses, not via the client — or the confirmation's reliability fails regardless of positive/negative design. And related-party balances are never negative-confirmation territory: the risk is never low, the balances are never homogeneous, and circular confirmations between group entities prove nothing. Any UAE file showing negative confirmations on related parties is a review finding waiting to happen.

MediCare Clinics LLC has 4,200 patient receivables totalling AED 2,100,000 (average AED 500), assessed risk low (insured billings, strong collection history, good controls). The auditor sends negative confirmations to all balances above AED 200 — 3,100 requests.

Results:

• Exceptions: 41 replies disagreeing (1.3%). Investigation: 28 are timing differences (payments in transit at year-end — confirmed via bank statements, no misstatement); 9 are billing errors totalling AED 6,300 (adjusted); 4 are duplicate billings totalling AED 3,100 (adjusted). Total misstatement found: AED 9,400.
• Exception rate analysis: 1.3% vs expected <1% — slightly above, but the monetary impact (AED 9,400 on AED 2,100,000 = 0.4%) is trivial, and the nature (billing errors, not fraud) supports the low-risk assessment.
• Non-responses: ~3,050 silences — accepted as agreement only because the three ISA 505 conditions held, and combined with the auditor's other procedures: re-performance of the billing system's ageing, subsequent-receipts testing on a sample, and analytical review of collection patterns.

Conclusion: negatives provided appropriate supplementary evidence; the AED 9,400 adjustment is booked; the file documents the conditions assessment. Had the exception rate hit 5% with fraud indicators, the auditor would have re-evaluated — likely switching to positive confirmations for the population.

Using them on high-risk balances. Related parties, concentrated debtors, or fraud-risk areas — ISA 505 forbids it, but files still show it.

Client-controlled process. The client sends the requests or supplies the addresses — the confirmation is compromised regardless of design.

Treating silence as strong evidence. Concluding existence from non-response alone, without the supplementary procedures ISA 505 expects.

Ignoring the exception pattern. A 4% exception rate waved through because 'the amounts are small' — the rate itself impeaches the low-risk assumption.

Wrong population. A few large balances among many small ones included in the negative sweep instead of carved out for positives.

No conditions documentation. The three ISA 505 conditions never assessed in writing — the reviewer cannot tell the design was ever appropriate.

Using negative confirmations for material or risky balances. Some UAE audit teams, pressed for time, send negative confirmations on large trade receivables and treat the silence as agreement. Reviewers reject this: the assessed risk demands positive confirmations or, failing response, alternative procedures like vouching subsequent cash receipts. Negative confirmations on a AED 2 million balance prove nothing except that the letter was posted.

Treating a low response rate as a result. With positive confirmations, non-response is not evidence — it is a prompt for alternative procedures. UAE teams sometimes report 'confirmations sent, 30 percent responded, no exceptions noted' as if the 70 percent silence were agreement. Standards require alternative procedures for material non-responses; the confirmation procedure is incomplete until they are done.

Positive confirmations are the stronger sibling — reply required either way. Bank confirmations are the most critical external confirmation in any UAE audit. ISA 505 is the governing standard. Audit evidence (ISA 500) sets the reliability hierarchy confirmations sit atop. Attribute sampling designs the selection when confirmations are sampled. And professional scepticism governs the evaluation — silence is not agreement until the conditions say it is.