Building an AS 2310 compliant audit confirmation workflow

As audit firms navigate increasingly complex regulatory landscapes and face mounting pressure from enforcement actions, the question is no longer whether to modernize confirmation processes. It’s how quickly you can build defensible, compliant workflows that protect your practice and your clients.

Recent regulatory developments, particularly the implementation ofPCAOB AS 2310, have fundamentally shifted expectations around confirmation reliability and documentation. For audit professionals, this represents both a challenge and an opportunity: the chance to transform confirmation processes from administrative burdens into , like faster audit cycles, reduced client burden, and quality consistency. 

Jump to ↓

When confirmation controls fail: The BF Borgers wake-up call

Building your defense: The three pillars of AS 2310-compliant confirmation processes

How structured workflows transform your practice

Building your AS 2310-compliant confirmation workflow

Ensure your confirmation workflow is audit-proof

When confirmation controls fail: The BF Borgers wake-up call

The SEC’s enforcement action against BF Borgers serves as a stark reminder of what happens when audit controls, including confirmation processes, fail to meet regulatory standards. The case highlighted critical deficiencies in audit procedures, inadequate documentation, and insufficient verification processes that contributed to broader audit failures.

While the BF Borgers case encompassed multiple control failures, it underscored a fundamental truth: traditional paper-based confirmation methods are inherently vulnerable to the risks that regulators are increasingly scrutinizing. When confirmation processes lack proper authentication, documentation, and timeliness controls, they become sources of audit risk rather than reliable evidence.

The ripple effects extend beyond individual enforcement actions. Firms face reputational damage, regulatory scrutiny, increased liability, and potential client attrition when confirmation controls prove inadequate. More importantly, these failures often signal systemic weaknesses in audit quality that can undermine an entire practice.

The lesson is clear: audit firms can no longer rely on confirmation methods that leave gaps in documentation, authentication, and compliance. The regulatory environment demands defensible processes that can withstand scrutiny and provide reliable audit evidence.

Building your defense: The three pillars of AS 2310-compliant confirmation processes

Creating audit-proof confirmation workflows requires a systematic approach built on three essential pillars. Each pillar addresses specific vulnerabilities while contributing to overall AS 2310 compliance and audit quality.

Pillar 1: Authentication – Verified four-party system

Traditional confirmation processes often rely on unverified communication channels that create opportunities for fraud and misrepresentation. Email addresses can be spoofed, postal mail can be intercepted, and responses can arrive from unauthorized sources without detection.

A robust AS 2310-compliant workflow requires authenticated communication between all parties: the auditor, the client, the confirming party, and the platform facilitating the exchange. This four-party verification system ensures that each participant’s identity is validated before any confirmation data is exchanged.

Verified networks eliminate ambiguity around authenticity by maintaining databases of validated financial institutions, legal firms, and other confirming parties. When confirmation requests and responses flow through authenticated channels, auditors can rely on the integrity of the communication without additional verification procedures.

Pillar 2: Documentation – Complete audit trail

PCAOB AS 2310 places significant emphasis on documentation and the reliability of confirmation evidence. Traditional paper processes often produce incomplete audit trails with gaps in timing, delivery confirmation, and response tracking.

A complete digital audit trail captures every step of the confirmation process: when requests were sent, delivery confirmations, read receipts, response timing, and any follow-up communications. This comprehensive documentation provides the evidence base that regulators expect and auditors need to defend their procedures.

Time-stamped records, delivery confirmations, and automated response tracking create an unbroken chain of evidence demonstrating compliance with AS 2310 requirements. When questions arise during regulatory reviews or litigation, this documentation provides clear answers about what happened, when it happened, and who was involved.

Pillar 3: Compliance – Built-in AS 2310 adherence

PCAOB AS 2310 establishes specific requirements for confirmation reliability, management involvement, and auditor procedures. Rather than retrofitting compliance onto existing processes, structured electronic workflows embed these requirements into the confirmation system itself.

Built-in compliance features ensure that AS 2310 requirements are met consistently rather than relying on manual procedures that can be overlooked or applied inconsistently. This includes proper documentation of management’s involvement, appropriate confirmation procedures for different account types, and sufficient audit evidence to support conclusions.

When compliance is systematically embedded in the workflow, it becomes a natural outcome rather than an added burden, freeing audit teams to focus on analysis and professional judgment.

How structured workflows transform your practice

While regulatory compliance drives the initial need for modernized confirmation processes, the benefits extend well beyond meeting AS 2310 requirements. Forward-thinking audit firms are discovering that structured electronic confirmation workflows provide competitive advantages that transform their practices.

According to Forrester’s report, the total economic impact of Confirmation, during busy season, electronic confirmations can reduce confirmation-related workload by 60–70% while improving response rates and evidence quality. Teams can initiate more confirmations in less time, track responses automatically, and focus on analyzing results rather than managing administrative processes.

Client service improves when audits move more efficiently. Faster confirmation turnaround contributes to shorter audit cycles, reduced client disruption, and more timely financial reporting. Clients appreciate auditors who leverage technology to minimize the administrative burden of the audit process.

From a risk management perspective, structured workflows provide stronger regulatory positioning and reduced liability exposure. When confirmation processes are defensible, well-documented, and compliant by design, firms can approach regulatory reviews with confidence.

Building your AS 2310-compliant confirmation workflow

Implementing structured electronic confirmation workflows requires careful planning and systematic execution. Start by assessing your current confirmation processes to identify vulnerabilities and compliance gaps. Document which confirmation types consume the most time, generate the most follow-up work, or carry the greatest regulatory risk.

Evaluate electronic confirmation platforms based on their ability to address the three pillars:

Authentication through verified networks
Comprehensive documentation and audit trails
Built-in AS 2310 compliance features.

Consider integration requirements with your existing audit software and the learning curve for your team.

Plan a phased implementation that minimizes disruption while maximizing benefits. Many firms begin with bank confirmations, typically the highest-volume type, before expanding to legal, accounts receivable, and specialized confirmations.

Train your teams on new processes and compliance requirements, emphasizing how structured workflows improve both efficiency and audit quality. Establish ongoing monitoring procedures to ensure that electronic confirmations continue to meet your quality standards and regulatory requirements.

Ensure your confirmation workflow is audit-proof

The implementation of PCAOB AS 2310 represents a watershed moment for audit confirmation processes. Firms can choose to react defensively to enforcement actions and regulatory pressure, or proactively build defensible, efficient confirmation workflows that provide competitive advantages.

The three-pillar framework, authentication, documentation, and compliance, offers a clear roadmap for transforming confirmation processes from potential audit risks into sources of reliable, defensible evidence. The question isn’t whether change is necessary; it’s whether you’ll lead the transformation or be forced to catch up.

Discover how Thomson Reuters Confirmation provides the verified, compliant platform trusted by 16,000+ audit firms worldwide to process over $1 trillion in financial data annually. Our comprehensive confirmation solutions deliver the three-pillar framework with built-in AS 2310 compliance, authenticated four-party verification, and complete audit trails.