Who sends a bank confirmation request, the client or the auditor?

The auditor. The client signs an authority allowing the bank to disclose its information, because the bank owes the customer confidentiality, but the auditor controls the request and the reply comes back directly to the auditor. That route is the point of the exercise: if the client carried the letter in either direction, the evidence would be no better than the client's own records. Many banks now answer through electronic confirmation platforms, which follow the same logic.

Can a company refuse to let its auditor contact the bank?

It can try, but there are consequences. Under ISA (NZ) 505, and its UK counterpart, an auditor whose request is refused by management must ask why, seek evidence that the reason is valid, consider what the refusal means for the risk of misstatement and fraud, and perform other procedures. If the refusal is unreasonable, or other evidence is not reliable, the auditor goes to those charged with governance and decides the effect on the audit opinion, which may then be modified.

Is a bank confirmation enough evidence that the cash exists?

It is good evidence that a balance exists at the date stated, and less useful for other questions. Australia's guidance notes that a confirmation may support existence but not accuracy, valuation or completeness. A balance can be real and still be pledged to another party, or be matched by an account nobody listed. Auditors therefore read the reply beside bank reconciliations, statements around the balance date, and evidence of any restrictions on the money.

What happens if the bank confirmation does not match the books?

The auditor investigates the difference. Timing items, such as a cheque in transit or a payment on the day, are usually easy to explain. A facility, guarantee or account that appears only on the bank's reply needs a reason, and may need a change to the accounts or a new note. Repeated or unexplained differences raise a question about the bookkeeping itself, and may cause the auditor to widen the work on cash and on transactions passing through the bank.

// WORKED EXAMPLEWHAT THE DOCUMENT DOES

Bank Confirmation: What an Auditor Asks a Bank

The ledger shows what the client recorded. The bank shows the rest.

BY MICHAEL SHANG · SIXTEEN YEARS IN COMMERCIAL BANKING · UPDATED 2026-11-09 · 6 MIN READ

// THE SHORT ANSWER

An auditor writes to a client's bank because a ledger can only show what the client chose or remembered to record. The reply, sent straight to the auditor under an authority the client signs, sets out what the bank itself has on its books at the chosen date: balances and limits, charges taken, bonds issued, hedging contracts written. It is a check on the accounts from outside them. Most of its worth lies in the items that come back with no matching line in the ledger, and in any question the bank has left blank.

BASIS Practitioner judgment from sixteen years in commercial banking, set out in How Bankers Think (Highbank Press, 2026). Every borrower on this site is a composite constructed for teaching, not a client. The market is mid-market commercial lending as practised in New Zealand and Australia; where a convention differs elsewhere, the page says so.

// MAKE THE CALL

Issue 07 — Coastline Retail Group. NPAT up 9%. Operating cash flow down 31%. The dividend consent request is on your desk. Your call first, then the senior banker's.

Read the file →

PART OF Credit Analysis for Beginners

// 01 — WHY AN AUDITOR WRITES TO THE BANK

Much of what a business has with its bank does not pass through ordinary bookkeeping. A performance bond is a promise, not a payment, so nothing reaches the ledger unless someone records it. A swap may live in a spreadsheet kept by the finance manager. A charge taken for a loan repaid years ago may still be on the bank's register. Evidence that comes directly from a party outside the business is harder to manipulate than evidence the business produced, and the bank is the one outsider that knows all of these.

The procedure sits under the international auditing standard ISA 505, which New Zealand issues as ISA (NZ) 505, Australia as ASA 505 and the UK as ISA (UK) 505. It is the auditor's choice in response to assessed risk rather than a fixed step: Australia's guidance says an auditor of a business with simple banking, low assessed risk and other sufficient evidence may decide not to send one. A company that is not audited at all has no confirmation, which is one reason a lender reads audited and unaudited accounts differently.

// 02 — WHAT THE BANK IS ASKED, AND WHO SIGNS

Australia's Guidance Statement GS 016 publishes model forms, and they give a fair idea of what a full request covers:

Balances every account at the date, with interest terms

Facilities limits, and what is unused

Liabilities bills, letters of credit, forward contracts

Guarantees bonds and guarantees the bank has issued for the

client, and those the client has given to the bank

Security what is held, how it is charged, and whether it

also supports another party

Set-off netting and compensating balances

Treasury swaps, options, forward rate agreements

Changes accounts opened or closed in the period

A bank owes its customer confidentiality, so the request travels with an authority signed by the client. The auditor keeps control of the process: the auditor sends the request, directly or through an electronic platform, and the answer comes back to the auditor rather than through the client. A reply may carry a disclaimer, and GS 016 says that does not of itself destroy its value as evidence. It also says that relying on the reply alone for completeness is generally unwarranted, because a question may go unanswered or the bank may be unable to gather everything. The auditor then has other routes, including the minutes, a word with the relationship manager, and a statement from management in its representation letter.

// 03 — THE EXAMPLE

A maker and installer of playground equipment, constructed for this page like every figure in it, has a 30 June balance date and one bank. Its directors sign the authority in early June and the auditor sends the request. The reply reaches the auditor in July.

US$m Ledger Bank's reply

Operating account (overdrawn) (1.10) (1.10)

Term loan (2.40) (2.40)

Retentions deposit account 0.35 0.35

Deposit account for a council tender none 0.06

Performance bonds issued to councils none 1.40

Guarantee of a sister company's loan none 0.90

Interest rate swap, notional amount none 1.50

Bank debt in the accounts: 1.10 + 2.40 = 3.50

Contingent, on the reply: 1.40 + 0.90 = 2.30

Bank's total lines to read: = 5.80

The three balances on the draft balance sheet agree to the cent. A reply limited to those would have told the auditor nothing new. The other four lines are what the exercise was for. The bonds are a call the councils could make on the bank, with recourse to the client. The guarantee means the maker stands behind US$0.90m its accounts do not mention. The swap may need to appear at fair value, depending on the framework the company reports under. The US$0.06m deposit is small, but an account the finance team did not list is a finding about how the books are kept.

The accounts change. A contingent liabilities note appears, the swap is assessed, and the sister company's position becomes a question for the auditor. Obligations in the bank's lines turn out to be two-thirds larger than the debt the draft showed (2.30 ÷ 3.50 = 66%). These figures belong to the example and say nothing about what is typical.

DEFINED IN ONE PARAGRAPH → · THE BANK IN YOUR AUDIT FILE → · GOING CONCERN AND BANK SUPPORT →

// 04 — HOW IT DIFFERS FROM THE LETTERS BESIDE IT

Three documents from a bank get confused. A confirmation reports facts at a date, from the bank's records, to the client's auditor. A status enquiry or bank reference gives a general view of a customer's standing to someone considering dealing with it, and says far less. A letter of support, or the factual letter a bank writes for a going-concern review, is about the future, and a bank can say little about a decision it has not yet made. An auditor who treats a confirmation of today's limit as evidence of next year's facility has read a statement of fact as a promise.

// 05 — WHERE IT DECIDES A FILE

For the bank answering, the reply is a statement that others will rely on, so it is worth more than a clerical chore. It is often prepared away from the relationship team, and it can expose the bank's own loose ends: a charge not released, a limit not formally renewed, a guarantee that expired but was not cancelled. A relationship manager who reads the reply before it goes out sees the customer as the auditor is about to.

For a lender reading the signed accounts, the contingent liabilities note is where the confirmation's work shows. A bond line that grows faster than revenue, a guarantee for a related company, or a cross-guarantee the borrower did not mention at the last review each changes the reading of a file. A confirmation that arrives late can also hold up the audit, and a facility agreement usually sets a deadline for delivering audited accounts, so a slow reply can become the borrower's problem with its own lender.

AUDIT AND ASSURANCE, READ BY A LENDER → · AUDITED, REVIEWED OR COMPILED →

// SOURCES

The documents the statements on this page rest on. Each was opened and checked when cited.

Auditing and Assurance Standards Board (Australia), Guidance Statement GS 016 Bank Confirmation Requests, June 2022 — paragraphs 8–10, 44–45 and 47, and the model forms — Lists what a confirmation may cover, says an auditor may decide not to send one in simple cases, and warns against sole reliance on it for completeness — sections 01 and 02.
External Reporting Board (New Zealand), ISA (NZ) 505 External Confirmations (compiled June 2021) — Sets out what the auditor does if management refuses to let a confirmation request be sent — the second question below.
Financial Reporting Council (UK), ISA (UK) 505 External Confirmations (Revised October 2023, updated October 2025) — paragraphs 7–9 — Carries the same auditor-control and management-refusal requirements for UK audits — section 01 and the second question below.

// QUESTIONS PEOPLE ASK

Who sends a bank confirmation request, the client or the auditor?: The auditor. The client signs an authority allowing the bank to disclose its information, because the bank owes the customer confidentiality, but the auditor controls the request and the reply comes back directly to the auditor. That route is the point of the exercise: if the client carried the letter in either direction, the evidence would be no better than the client's own records. Many banks now answer through electronic confirmation platforms, which follow the same logic.
Can a company refuse to let its auditor contact the bank?: It can try, but there are consequences. Under ISA (NZ) 505, and its UK counterpart, an auditor whose request is refused by management must ask why, seek evidence that the reason is valid, consider what the refusal means for the risk of misstatement and fraud, and perform other procedures. If the refusal is unreasonable, or other evidence is not reliable, the auditor goes to those charged with governance and decides the effect on the audit opinion, which may then be modified.
Is a bank confirmation enough evidence that the cash exists?: It is good evidence that a balance exists at the date stated, and less useful for other questions. Australia's guidance notes that a confirmation may support existence but not accuracy, valuation or completeness. A balance can be real and still be pledged to another party, or be matched by an account nobody listed. Auditors therefore read the reply beside bank reconciliations, statements around the balance date, and evidence of any restrictions on the money.
What happens if the bank confirmation does not match the books?: The auditor investigates the difference. Timing items, such as a cheque in transit or a payment on the day, are usually easy to explain. A facility, guarantee or account that appears only on the bank's reply needs a reason, and may need a change to the accounts or a new note. Repeated or unexplained differences raise a question about the bookkeeping itself, and may cause the auditor to widen the work on cash and on transactions passing through the bank.

// NEXT TO IT

// ON WHOSE DESK

The seats that read this term in an ordinary week. Each page says what the seat is for, who arrives in it, and the shape of the round it runs.

Transaction bankerSells and structures the plumbing a business runs on — accounts, payments, collections, liquidity and trade finance.
Personal bankerThe bank's face in a branch or on a phone: everyday accounts, cards, personal lending and the first conversation about a home loan.
Operations analystRuns the processing every product depends on — payments, onboarding, settlements, servicing — at volume.

THE IN-TRAY · ONE MINUTE

Make the call on one file.

A short file on the ground this page covers. Every option opens with how far it sits from a senior banker’s read.

THE FIRST QUESTION · THE BORROWER · EARNINGS

A travel agent now reports only its commission as revenue, instead of the full price of the holidays it sells. Revenue fell from US$80m to US$12m; profit is unchanged.

What happened to the business?

6 MORE ON THE BORROWER · EARNINGS →WHERE DO YOU READ FROM? THE PLACEMENT →

THE READING ROOMIN ONE PARAGRAPHBank confirmation (audit) What is a bank confirmation in an audit, and what does it include?