The Institute of Chartered Accountants of India (ICAI) has issued a warning to auditors regarding the use of third-party vendors for external confirmations from banks. While external confirmations are crucial for audit evidence, the ICAI notes that banks increasingly use third-party vendors for this purpose. This practice introduces risks concerning the authenticity and completeness of the information provided, as well as uncertainty over responsibility for IT control failures at the vendor level. As there's currently no legal framework to address these issues, auditors are advised to obtain direct confirmations from banks to mitigate potential risks.
Auditing and Assurance Standards Board
The Institute of Chartered Accountants of India
7th September, 2022
External Confirmations through Third Party Vendors
External confirmations have been an important and integral part of audit procedure in order to obtain sufficient appropriate audit evidence in line with requirement prescribed in various Standards on Auditing (SAs). Over the years, auditors have been using external confirmations to obtain account balances confirmation from various parties (confirming parties) including banks.
However, it has come to the notice of the Institute of Chartered Accountants of India (ICAI) that, in recent years, auditors are facing various difficulties in obtaining external confirmations from banks. One of the major concern in this regard is that some banks are using services of third-party vendors to provide confirmations on their behalf to auditors. Use of third-party vendors leads to the risk that the information provided by third-party vendors may not be authentic and complete. Further, it is not clear as to who will be responsible in case there is failure of IT controls at the end of third-party vendors which may impact the integrity of information provided.
These factors raise a question as to who will be held responsible for authenticity and completeness of information provided to auditors, the concerned bank or such thirdparty vendors. Presently, there is no legal framework/guidelines to deal with these aspects. Thus, auditors are exposed to serious risk, in case they use the confirmation from such third-party vendors as audit evidence.
Keeping in view the above, the auditors are advised to seek direct confirmation from concerned banks.