An external confirmation letter is the request an auditor uses to verify a balance or other information not from the company's own ledger, but through a direct written response from a third party. Under ISA 505, applied in Türkiye as BDS 505, the auditor decides who receives the request, what it asks and how it is sent, and the reply goes straight to the auditor rather than back to the company. The letter may carry your letterhead; the process belongs to the auditor.
That is where finance teams get confused. The reconciliation letter you send every year and your auditor's confirmation request look almost identical: same letterhead, a similar balance line, a signature block. Yet one is commercial correspondence and the other is audit evidence.
This guide looks at confirmations from the audited company's side of the desk: which balances go out for confirmation, how the request types differ, what happens when replies do not come back, how to structure the letter and what to prepare before audit season.
An external confirmation letter is not your own reconciliation letter
In Türkiye, auditing standards are issued by the Public Oversight, Accounting and Auditing Standards Authority (KGK). BDS 505 "External Confirmations" was published in the Official Gazette of 30 December 2013 (No. 28867) as Turkish Auditing Standards Communiqué No. 18, and KGK's current text is a Turkish translation of ISA 505 as published in the IAASB's 2022 handbook. The IAASB is reviewing ISA 505 within its ISA 500 Series project, but the text in force has not changed.
The standard defines an external confirmation as audit evidence obtained as a direct written response to the auditor from a third party, in paper form, by electronic means or in another medium (paragraph 6; Turkish text: BDS 505).
The decisive rule is paragraph 7: the auditor maintains control over confirmation requests, determining the information to be confirmed, selecting the confirming party, designing the request (including the return information that ensures replies come directly to the auditor) and sending it, with follow-ups where needed. Why, then, does the letter usually go out on company letterhead with a management signature? Paragraph A4 recognises that confirming parties may only be willing to respond to a request that contains management's authorisation. The signature grants permission. It does not transfer ownership of the process.
- Who selects the counterparty: for your own letter, you; for a confirmation, the auditor.
- Who sends it: you send your own letter; dispatch of a confirmation is under the auditor's control.
- Where the reply goes: to you, versus directly to the auditor.
- What silence means: for your own letter, it depends on the contractual relationship; for a confirmation, silence is simply a non-response.
In iFinances, a company's own letter is produced as a per-currency summary table with a serial number and an archive for the signed copy; it does not replace the auditor's confirmation. For a commercial template, see our reconciliation letter template for Word and Excel.
One more term causes confusion. In Turkish finance teams, the everyday term "teyit mektubu" (confirmation letter) usually refers to a company's own reconciliation letter. Under Article 21(3) of the Turkish Commercial Code (TTK), however, a confirmation letter confirms the content of a contract concluded orally or at a distance and carries an eight-day objection period, while the written representations under BDS 580 (ISA 580) travel from management to the auditor. An ISA 505 confirmation is none of these.
Which balances do auditors send for confirmation?
External confirmation is not automatic for every balance. Paragraph 19 of ISA 330 requires the auditor to consider whether external confirmation procedures are to be performed as substantive procedures, so the selection follows the risk assessment. The application material to ISA 330 lists typical candidates:
- Bank balances and other information relevant to banking relationships
- Accounts receivable and payable balances and terms
- Loans from lenders, including repayment terms and restrictive covenants
- Inventories held by third parties or on consignment, and investments held in custody
- Terms of agreements, including the absence of side agreements
Bank confirmation letters
A bank confirmation letter usually asks about more than the balance, and ISA 505 notes that a reply is more reliable when the request goes to someone knowledgeable about the information, such as a bank official who knows the transactions. On the company side, the precondition is a reconciled bank account, which our step-by-step bank reconciliation guide walks through.
Receivable and payable confirmations
On receivables, a common misreading is to treat a confirmed balance as a collectible one. ISA 330's application material says confirmations provide more relevant evidence that a receivable exists than that it is recoverable. It also notes that a counterparty may describe transactions in a different currency and that related-party replies may be less reliable. Prepare balances currency by currency and flag intercompany accounts separately.
Positive vs negative confirmation in an audit, and the blank request
A positive confirmation request asks the confirming party to reply directly to the auditor, stating whether it agrees or supplying the requested information. A negative confirmation request asks it to reply only if it disagrees. A blank confirmation is a variant of the positive request: paragraph A5 notes the risk that a party agrees without checking, which the auditor can reduce by leaving the amount out and asking the counterparty to fill it in, at the cost of lower response rates. Turkish finance teams use the same idea in commercial letters under the name "bakiyesiz mutabakat", a balance-free reconciliation letter; see our blank confirmation glossary entry.
Negative confirmations look convenient but have limits. Paragraph 15 says they provide less persuasive evidence and cannot be the sole substantive procedure unless all four conditions are present: the risk of material misstatement is assessed as low and sufficient evidence has been obtained on the operating effectiveness of relevant controls; the population consists of a large number of small, homogeneous items; a very low exception rate is expected; and the auditor is not aware of circumstances that would cause recipients to disregard the request.
Is silence on a negative confirmation an acceptance?
No. Failing to receive a reply to a negative request does not explicitly indicate that the confirming party received the request or verified the information. Parties are more inclined to respond when the information is not in their favour.
This is often mixed up with Article 94 of the Turkish Commercial Code. In a current account relationship, a party that receives the closing balance statement and does not object within one month by notary, registered letter, telegram or a document with a secure electronic signature is deemed to have accepted the balance.
That consequence, however, operates in the context of a written current account agreement (Article 89 requires written form) and does not attach automatically to every reconciliation letter. For audit purposes the position is clear: under ISA 505, silence on a negative request is not evidence of agreement, whatever its commercial effect between the parties. Ask your legal adviser how this applies to your own contracts. Details are in what happens when no one replies to a reconciliation letter.
When confirmation replies don't arrive or don't match your records
A non-response covers not only a positive request that gets no reply or an incomplete one, but also a request returned undelivered. The auditor may first follow up, for example after re-verifying the address. If there is still no reply, paragraph 12 requires alternative audit procedures, and paragraph A18 tells you what you will be asked for:
- Receivables: subsequent cash receipts, shipping documentation and sales near the period end
- Payables: subsequent cash disbursements, correspondence from third parties and records such as goods received notes
If the auditor has determined that a response to a positive request is necessary for sufficient appropriate evidence, alternative procedures will not provide it; if confirmation is not obtained, the auditor determines the implications for the audit and the opinion under ISA 705 (paragraph 13).
How the reply arrives matters too. A reply received indirectly is a reason for doubt, and if a reply was sent to the company's address by mistake, the auditor may ask the confirming party to respond in writing directly to the auditor. An oral response on its own does not meet the definition of an external confirmation.
When a reply differs from your records, an exception, the auditor investigates whether it indicates a misstatement (paragraph 14). Not every exception is an error: differences can stem from timing, measurement or clerical matters. A company that has already listed goods-in-transit invoices, value-date shifts and FX differences item by item shortens that investigation. Why an agreed total can still hide mismatched lines is the subject of the balance matches, the lines don't.
When management refuses to allow a confirmation
Under paragraph 8, the auditor enquires into management's reasons, evaluates the implications for the assessed risks of material misstatement, including fraud risk, and performs alternative procedures. The application material notes that a common reason advanced is an ongoing legal dispute or negotiation with the counterparty, but the auditor still has to seek evidence that the reason is valid and reasonable, because a refusal may be an attempt to deny access to evidence that could reveal fraud or error. A refusal without a reasonable basis may be a fraud risk factor under ISA 240.
If the refusal is unreasonable, or alternative procedures cannot deliver sufficient evidence, the auditor communicates with those charged with governance and determines the implications for the audit and the opinion under ISA 705 (paragraph 9). In Türkiye, Article 401 of the Turkish Commercial Code also requires the board of directors to give the auditor the access needed to examine books, correspondence and documents.
External confirmation letter template: a skeleton with direct-reply instructions
The skeleton below is a starting point, not a prescribed form. The auditor decides the final wording and the parties to be confirmed, and if your audit firm has its own template, that one prevails.
[COMPANY LETTERHEAD] · Date: [dd.mm.yyyy] · To: [counterparty legal name], Tax ID [number], Attn: [name, title]
Subject: Balance confirmation for audit purposes as of [cut-off date]
Our financial statements are being audited by [audit firm name]. Please confirm in writing, directly to our auditors, the balance shown in your records as of [cut-off date]. This is not a request for payment.
Positive version: According to our records, the balance is TRY [amount] [debit/credit], USD [amount] [debit/credit], EUR [amount] [debit/credit]. Please tick "We agree" or "We do not agree"; if you do not agree, state your balance and the items that explain the difference.
Blank version: Please fill in the balance per your records, by currency and with its debit or credit direction.
Please send your reply not to us but to: [audit firm name], [engagement contact], [postal address], [email address].
For the company: [name], [title], signature/stamp · Counterparty reply: [legal name], [authorised signatory, title], date, signature/stamp
Three points to watch when drafting:
- Leave out any deemed-acceptance clause. A line such as "if we do not hear from you by the stated date, the balance will be deemed accepted" has no place in an audit confirmation; a non-response is only a non-response.
- The auditor sets the reply channel. Because the origin and authority of electronic replies can be hard to establish, additional safeguards may be needed.
- The negative version is one sentence: "Please write to our auditors only if you do not agree." Given the paragraph 15 conditions, it is used in limited situations.
You can see how a company's own letter is produced on our reconciliation letters page.
Before audit confirmations arrive: seven preparation steps
Start with scope, because the thresholds for statutory audit in Türkiye changed in 2026. Presidential Decision No. 11066 of 16 March 2026 (Official Gazette of 17 March 2026, No. 33199) set the thresholds for companies subject to the general criteria at TRY 500 million in total assets, TRY 1 billion in annual net sales and 150 employees, used in determining audit status for financial periods starting on or after 1 January 2026.
A company that exceeds at least two of the three thresholds in two consecutive financial periods becomes subject to audit from the following period. Our guide to audit-ready reconciliation for KGK audits covers the detail.
1. Run your own reconciliation before the confirmations do. A difference first seen in a confirmation reply is the most expensive kind; have a line-level difference list ready before the season.
2. Update your contact list. The auditor may test some or all addresses before sending requests; keep the accounting contact, email and postal address current.
3. Clean up reversed and related-party balances. Our article on credit balances in receivables and debit balances in payables explains the method.
4. List every bank, loan, collateral item and asset held by third parties. Nothing on the ISA 330 list of typical candidates should be missing.
5. Document timing differences. Goods in transit, value-date shifts and FX differences are the explanations for tomorrow's exceptions.
6. Build the alternative-procedures file. Keep subsequent receipts and payments, shipping documents and goods received records within reach.
7. Raise sensitive counterparties early. If a dispute or negotiation makes you reluctant to have a party confirmed, tell the auditor in advance and explain why.
To see where you stand, try the External Confirmation Readiness Assessment.
iFinances helps most with steps one and five. It matches your ERP or ledger records, bank statements and e-invoice data line by line, keeps a written rationale for every match and lists the unmatched items; fuzzy matching only produces suggestions, and a person makes the decision. Your team records the reason for each difference, such as an FX difference or a written note. If you keep reconciliation running through the season, the line-level difference list is current when confirmation replies come back with exceptions.
iFinances is not an auditor: it does not send ISA 505 confirmation requests on the auditor's behalf, does not issue an audit opinion, does not post to your ledger and never clears a line on its own. How the audit trail is built is described on our internal audit reconciliation page.
To enter year end with clean balances, our year-end reconciliation calendar and checklist is a good place to start. If you would like to see how the lines match for the counterparty that raises the most questions, get in touch.
Frequently Asked Questions
Do I have to reply to an audit confirmation from my customer's auditor?
ISA 505 governs how the auditor gathers evidence; it does not place an obligation on the confirming party. A positive request still expects a reply, and without one the auditor has to perform alternative procedures, which adds work to your customer's audit. A negative request asks you to write only if you disagree, but silence is not treated as audit evidence of agreement; reply in writing to the auditor's address given in the request. Your contract with the customer or other rules may still create a separate obligation; for your specific situation, check with your legal adviser.
In an audit, what is the difference between positive, negative and blank confirmations?
A positive request asks the confirming party to reply directly to the auditor in every case; a negative request asks it to reply only if it disagrees. A blank confirmation is a positive request with no amount stated, so the counterparty fills in the balance from its own records; it reduces the risk of agreeing without checking but may lower response rates. Negative confirmations provide less persuasive evidence and, under paragraph 15 of ISA 505, cannot be the sole substantive procedure unless four conditions are all present.
What if the confirmation reply is sent to the audited company by mistake?
Under ISA 505, a reply that reaches the auditor indirectly is a factor that calls its reliability into question. In that situation the auditor may ask the confirming party to respond in writing directly to the auditor. Our practical advice is to pass the envelope or email to the auditor without acting on it and to help the counterparty resend its reply to the auditor.
What happens if management refuses to let the auditor send confirmations?
The auditor enquires into management's reasons, seeks evidence of their validity and performs alternative procedures. An ongoing legal dispute or negotiation with the counterparty is a common reason advanced, and the auditor still tests whether it is valid and reasonable. If the refusal is unreasonable or sufficient evidence cannot be obtained, the auditor communicates with those charged with governance and determines the implications for the audit and the auditor's opinion under ISA 705.
Are email confirmation replies acceptable under ISA 505?
They can be. ISA 505 defines an external confirmation as a direct written response received in paper form, by electronic means or in another medium. Because origin and authority are harder to establish for email replies, the auditor may perform additional checks, such as calling the confirming party. An oral response on its own does not meet the definition of an external confirmation.
✦ iFinances — See what you're missing.
