Depending on the auditor's risk assessment, there are some choices as follows:
- If the auditor assesses the relevant risks as high, the sending of confirmation letters should be done by the audit firm to ensure the most reliable audit evidence. However, this practice will cost more time and effort for both the audit firm and the enterprise as the processing procedures will be more complex to ensure adequate responses are received.
- If the auditor assesses the risks as not high, the auditor may request the enterprise to send. However, the auditor must apply controls over the entire implementation process to ensure that all letters are sent in accordance with the auditor's instructions, the content of letters is appropriate, the replies must be sent directly to the auditor. This approach will same more time and effort for both the auditor and the enterprise. However, there is a potential risk that this procedure may be illegally interfered with by the people in the business to conceal fraud (if any).