External confirmations and component auditors by link
How external confirmations and component auditors work in Achekam when banks, debtors and other auditors have no login, and what the team still sends.
By Achekam · · 4 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
A debtor confirmation that comes back by way of the client's own financial manager, forwarded "for your convenience", is not much of a confirmation. ISA 505 is clear that the auditor keeps control over external confirmation requests: who they go to, what they say, and that the replies come straight back to the auditor. The same principle runs through group audits under ISA 600 (Revised), where the group engagement team needs to know that its instructions reached the component auditor and that what came back is what the component auditor actually sent.
Both problems involve outsiders who will never have an account with your firm's software. This article explains how Achekam deals with them: external confirmations answered through single-use links, and component auditors working through a link of their own.
Nobody outside the firm signs in
Start with the general rule. Achekam has no client sign-in or client portal account. People outside the firm deal with it through the links it sends. That applies to clients, and equally to the banks, debtors, lawyers and component auditors that an audit team needs answers from.
For confirmations this is a strength rather than a gap. A respondent does not have to create an account to reply, which removes one more reason for a busy bank official to ignore the request.
Planning confirmations, with a second person
Under Audit & Assurance, External Confirmations, staff plan the confirmations for the engagement and prepare the requests. A different person approves each request before it goes. That approval is the moment to check the things ISA 505 cares about: is the respondent the right party, is the address independently obtained rather than taken from the client without checking, and does the request ask for the right information?
Sending stays with the audit team
Achekam does not send confirmation requests itself. Staff send them and record how they were sent. That fits ISA 505's emphasis on the auditor's control: the team decides the channel, whether a bank's own confirmation process, e-mail to a verified address or another route, and the file shows what was done.
Each respondent answers through a single-use link. Once it has been used, it cannot be used again, so a forwarded copy of the request cannot produce a second, different reply.
A worked example in words: the team plans confirmations of the year-end balances of a sample of the client's largest debtors. The senior prepares the requests using contact details obtained from the debtors' own invoices and websites rather than from the client's master file. The manager approves them. The senior e-mails each request from the firm's mailbox and records the date and address. Replies arrive through the single-use links. Where a debtor does not reply, the team performs alternative procedures, such as agreeing the balance to subsequent receipts, and documents them.
Group audits: components, scope and instructions
For a group audit, staff use the Group Audit Control Tower. Each component is recorded with its scope, its materiality and its component auditor, and the group team issues instructions to each component auditor from there. The IAASB's page on ISA 600 (Revised) describes the standard on audits of group financial statements, including when component auditors are involved.
This gives the group engagement partner one place to see the state of the whole group: which components are in scope, at what materiality, with which auditor, and whether the instructions have gone out.
Component auditors work by link
Each component auditor works through a portal link. Through it, the component auditor acknowledges the instructions, uploads deliverables and reports misstatements found at the component.
The token in that link is the only credential. Treat the link the way you would treat a password: send it to the named person at the component firm, at an address you have checked, and do not copy it into group-wide e-mails. If a component auditor changes partway through the audit, issue a fresh link to the new person rather than asking the old one to forward theirs.
Confirmations are not client requests
Keep confirmations separate from ordinary requests to the client. Requests to clients for documents, answers and confirmations of their own, such as a management representation or a schedule of related parties, go through the RFI console, which tracks every request whichever screen it was raised from. Third-party confirmations under ISA 505 go through External Confirmations. Mixing them blurs the evidence: a balance the client "confirms" is not external evidence.
| Who is asked | Where it is managed | Who sends it | How they reply |
|---|---|---|---|
| Bank, debtor, creditor, lawyer | External Confirmations | Audit team, recording how | Single-use link |
| Component auditor | Group Audit Control Tower | Group team issues instructions | Portal link: acknowledge, upload, report misstatements |
| The client itself | RFI console | Audit team | Personal request link |
A short checklist
- Plan confirmations at the interim stage, so addresses can be verified in good time.
- Have every request approved by someone other than its preparer.
- Send from the firm, record the method and date, and never route requests through the client.
- Follow up non-replies and document alternative procedures.
- Record each component's scope, materiality and auditor before instructions are issued.
- Send component links only to named, verified people.
If the work is part of an engagement where another firm reviews or audits statements your firm prepared, the arrangement is different again; see sending statements to another firm for review. Results from confirmations and component work then flow into drafting and approving the auditor's report.
Next step
Look at how your team obtained confirmation addresses on the last audit. If most came from the client's own records without checking, fix that in your planning template before the next confirmation round; no system can make a request reliable if it went to the wrong address.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
