Developments in international auditing standards often raise a practical question: must the confirmation procedures auditors use today be changed right away? The question is relevant because the International Auditing and Assurance Standards Board (IAASB) is working on a revision of ISA 505 on external confirmations. The short answer: the draft deserves monitoring, but discussion of an international project does not automatically replace the standards that apply to engagements in Indonesia.
In its October 2026 eNews, the IAASB reported that at its September 2026 meeting it discussed the first full draft of proposed ISA 505 (Revised), together with proposed ISA 501 (Revised) as it relates to inventory. The project is still at the exposure draft development stage, not a final standard. This article therefore separates project news from audit obligations that already apply.
What Is the IAASB Working On?
According to the ISA 500 Series project page, the IAASB is revising the audit evidence standards related to inventory (ISA 501, the inventory part only) and external confirmations (ISA 505). The aims are to modernize these standards, including considering the implications of the use of technology by entities, auditors and the organizations they interact with; to promote more consistent practice and behavior in obtaining and evaluating audit evidence; and to reinforce the appropriate exercise of professional skepticism.
The same project page shows an indicative timeline: an exposure draft targeted for December 2026, a comment period still marked "TBC", and approval of the final standard targeted for March 2028. Timelines like this can shift, so they should be read as a work plan, not as effective dates.
- Jun 2026Board papers on the ISA 500 Series project discussed.
- Sep 2026IAASB discussed the first full draft of ISA 505 (Revised).
- Dec 2026Exposure draft target in the project timeline.
- TBCPublic comment period on the exposure draft.
- Mar 2028Target approval of the final standard.
Draft — not yet effective. For engagements in Indonesia, the applicable IAPI SA 505 remains the reference.
Project objectives are not the same as the wording of final requirements. News of a draft discussion is no basis for concluding that every proposal will be approved unchanged. If an exposure draft is issued for comment, its content remains a proposal, not an effective requirement. Check the document version and status on the IAASB website before using it as the basis for internal policy.
The distinction in terms also matters: an ISA is an international standard issued by the IAASB, while an SA is an Auditing Standard set by the Indonesian Institute of Certified Public Accountants (IAPI). Sharing a number and topic does not mean a change to an ISA directly changes the SA. The ISA 505 revision is also part of a wider update of the audit evidence series; see Audit Evidence in the AI Era: Reading Proposed ISA 330, 500 and 520.
Indonesia's Current Reference: Control over Requests
The IAPI Auditing Standards page lists SA 505 External Confirmations in the 2025 Auditing Standards group, and SA 505 (Revised 2021), which is effective for audits of financial statements for periods beginning on or after 1 January 2022. The discussion below refers to the summary of SA 505 (Revised 2021) on that page; confirm which edition applies to your engagement period.
According to the IAPI summary, SA 505 deals with the auditor's use of external confirmation procedures to obtain audit evidence under SA 330 and SA 500. The auditor's objective is to design and perform those procedures to obtain relevant and reliable audit evidence. Simply receiving a reply is therefore not enough; the auditor needs to assess whether the reply answers the purpose of the procedure.
IAPI also stresses that the auditor must maintain control over external confirmation requests, covering the following four matters.
- 1Determine the informationWhat information is to be confirmed or requested.
- 2Select the partyThe appropriate confirming party.
- 3Design the requestProperly addressed and containing return information so responses are sent directly to the auditor.
- 4Send & follow upSend the request, including follow-up requests when applicable.
The response returns directly to the auditor, not through the audited entity.
This sequence is not mere administration. If the wrong party is addressed, the information requested is vague, or the response channel is not secured, the quality of the evidence can be impaired even though a letter or message has been received.
In practice, the first question is not "how many confirmations must be sent?" but "which assertions and risks are we trying to address?". Confirmations can be directed at balances or at the terms of a relationship with an outside party, as long as the procedure fits the audit objective. The auditor then considers who has the knowledge to respond, what information needs to be requested, and how the response will be received directly and remain traceable. This example illustrates a risk-based approach; it is not a list of mandatory procedures.
Evaluating Responses, Not Just Collecting Them
The value of a confirmation depends on its relevance and reliability. A response that looks complete still needs scrutiny if the sender's identity, the delivery route, or its content raises questions. Nor should the absence of a response be read as agreement with the amount asked about; the auditor needs to assess its effect on the evidence required and design appropriate follow-up.
The IAPI summary sets out two important limits:
- Negative confirmations provide less persuasive audit evidence than positive confirmations. The auditor therefore must not use negative confirmation requests as the sole substantive audit procedure to address an assessed risk of material misstatement at the assertion level.
- Required positive responses. Where the auditor has determined that a response to a positive confirmation request is necessary to obtain sufficient appropriate audit evidence, alternative audit procedures will not provide the audit evidence the auditor requires. If that confirmation is not obtained, the auditor must determine the implications for the audit and the auditor's opinion under SA 705 (Revised 2021).
When communication takes place electronically, attention to procedural control does not diminish. The auditor can assess whether the confirming party's address has been verified, whether the response channel truly leads directly to the audit team, and whether the electronic evidence is traceable. These are control questions derived from the objective of obtaining relevant and reliable evidence, not a claim that the ISA revision has mandated any particular platform or technology. For more on the opinion side, see Understanding Audit Opinions on Financial Statements.
Draft
ISA 505 (Revised) — IAASB
- Stage: exposure draft development
- First full draft discussed in September 2026
- Exposure draft target December 2026; approval target March 2028
- Focus: technology, consistent practice, professional skepticism
In force
SA 505 — IAPI
- SA 505 (Revised 2021) applies to periods beginning on or after 1 January 2022
- Auditor control over confirmation requests
- Negative confirmations not the sole substantive procedure
- A required positive response cannot be replaced by alternative procedures
What Should Be Prepared Now?
- Map the confirmation procedures in use: the purpose of each request, the source of its answer, and how control over sending and receiving is evidenced.
- Evaluate weak points that are often missed, such as responses forwarded by the audited entity, address changes without verification, or answers that do not cover the assertion being tested.
- Document the reasons when the auditor chooses follow-up or other procedures, including any remaining limitations of the evidence.
- Monitor the issue of the IAASB exposure draft and, if a final standard is issued, its adoption process and effective date in Indonesia.
These steps are not new instructions from the IAASB draft. They are practical ways to review whether work is consistent with the objectives and controls in the applicable SA 505. Once the exposure draft is issued, its proposals can be compared specifically with current practice before engagement guidance is changed.
Conclusion
The ISA 505 revision project signals that audit evidence and external confirmation issues continue to evolve, especially in increasingly digital working environments. However, according to the latest IAASB news, the project is still at the draft development stage. For auditors in Indonesia, the immediate focus remains applying the SA 505 in force: designing requests according to risk, controlling the process, and evaluating responses as evidence rather than as a formality.
Need to discuss audit procedures aligned with the applicable standards? See our Financial Statement Audit service.
Official References
- IAASB: eNews October 2026 (5 October 2026)
- IAASB: ISA 500 Series (Inventory and External Confirmations) — project page
- IAPI: Standar Audit (SA), including SA 505 (Revised 2021) External Confirmations
This article is general information and does not replace reading the full standards, professional judgement on a specific engagement, or legal advice. The status of standards and drafts may change; check official IAASB and IAPI publications before making decisions. The Indonesian version is the original text.