How does a broker-dealer end up with an audit confirmation that nobody actually signed, and what does the firm do about it when the discovery lands mid-inspection? The short answer: someone on the engagement team stopped controlling the channel the confirmation traveled through. The longer answer is the one the PCAOB keeps writing into its inspection reports. AS 2310 replaced a thirty-year-old standard precisely because the mail-it-and-wait model stopped matching how balances get verified today.
For small and mid-size broker-dealers, this is where findings land, where restatements start, and where frauds slip through. The decisions below are the ones firms and their auditors have to make before the next audit cycle closes.
Decide Who Really Controls the Confirmation Channel
The first decision is whether the audit team genuinely controls the path a confirmation travels, request through signed response, or whether the client sits anywhere in the middle. Control sounds procedural. It is the single thing that separates a real confirmation from a piece of paper with a signature on it. Experienced broker-dealer audit specialists tend to build their risk assessment around who touches the channel at each step, rather than a generic request list.
The standard is explicit. PCAOB guidance requires the auditor to maintain control over confirmation requests and responses by establishing direct communication with the intended recipient, so results can’t be intercepted or altered. If the client printed the request, forwarded the response, or supplied the reply address without independent verification, control was likely compromised.
The James Shepherd case keeps showing up in training decks for a reason. Box the owner controlled, addressed to a bank employee who didn’t exist. Every signature came back clean. None of them were real.
Decide Whether an Intermediary Actually Reduces Your Risk
Third-party confirmation platforms are the default now for good reason. They cut turnaround time, standardize the request format, and create a record the engagement team can point to. Useful tools, all of them. They do not replace the auditor’s own judgment about who is on the other end.
The real question is what the platform actually verifies. Some validate the responder’s identity against bank-side credentials. Others verify an email domain, which is a weaker control than it sounds when the counterparty is a small custodian, an introducing broker, or a private fund administrator. Before relying on an intermediary, the engagement team should be able to answer three things in writing:
- Identity verification. How does the platform confirm the responder is authorized by the counterparty, and is that evidence available to the auditor on request?
- Response integrity. Can the response be altered after submission, and if an exception is raised, is the audit trail preserved?
- Fallback procedures. What happens when the counterparty refuses to use the platform, and does the firm have a documented non-platform process that still maintains auditor control?
Decide How to Handle a Nonresponse Before It Becomes a Finding
Nonresponses are where small firms lose the most ground. A request goes out, nothing comes back, and the file ends up with a vague note about alternative procedures that don’t quite reach the balance in question. PCAOB Chair Erica Williams made the point directly when the Board modernized the standard: dropping a request in the mail and assuming the information is accurate when “nothing comes back” no longer makes sense.
Silence is not evidence. For broker-dealers, this hits hardest on cash held at clearing banks, customer securities positions at carrying brokers, and balances with affiliated entities where the counterparty has limited incentive to respond quickly. The decision isn’t whether to send a reminder. It’s whether the alternative procedures the team pivots to can actually corroborate the assertion the confirmation was meant to test, with evidence the auditor obtained independently.
Decide What to Fix Before the Next Inspection Cycle
The deficiency rate on broker-dealer engagements is not trending in a direction anyone wants. Firms being inspected for the first time fare worst, and the pattern suggests the fix isn’t a bigger checklist. It’s a tighter set of decisions about who touches the confirmation, how the responder is verified, and what the team does when the response doesn’t arrive.
The confirmation signed by nobody is a symptom. The disease is a process in which control over the channel got handed off, somewhere between the request and the reply, without anyone noticing. Decide now where that handoff happens in your current workflow. Then close it before an inspector finds it first.