Letter to PCAOB on the Proposed Auditing Standard

Office of the Secretary
Public Company Accounting Oversight Board
1666 K Street, NW
Washington, DC 20006-2803

To Whom It May Concern:

The American Bankers Association (ABA) welcomes the opportunity to comment on the Public Company Accounting Oversight Board's (PCAOB) Proposed Auditing Standard – The Auditor's Use of Confirmation, and Other Proposed Amendments to PCAOB Standards (the Proposal). The Proposal seeks to modernize the confirmation process, which is based on standards that took effect in 1992 and adopted as a PCAOB interim standard in 2003 (AS 2310). Currently, third-party confirmation procedures are pervasive both in audits of bank financial statements as well as auditors' use of confirmations, in which banks are requested to confirm balances of the auditees. We commend the PCAOB for taking steps towards modernizing the confirmation process standards to better reflect the significant advances in technology since the current standard was developed over thirty years ago.

Along with advances in technology have come new risks and opportunities that need further consideration. Specifically, the PCAOB should reconsider the confirmation process in the context of imposter scams such as phishing because fraudsters can use confirmation as a pretext for obtaining financial information. In addition, the procedures will be less effective given industry and government efforts advising customers not to provide financial information in response to unexpected requests.

ABA's specific comments on the Proposal are as follows:

Direct Solicitation of Financial Information from Consumers Via the Use of Confirmations as Required by the Proposal may be Used to Scam Consumers and are Inconsistent with Government and Banking Industry Efforts to Prevent Scams

In addition to circumstances discussed below when the required use of third-party confirmations are ineffective and outdated, the PCAOB should reconsider confirmation requirements broadly, as they may be used to defraud consumers. For example, fraudsters attempting to perpetuate phishing schemes could claim to be independent auditors of the financial institution where the consumer banks and point to PCAOB auditing standards regarding confirmations as their justification for obtaining sensitive financial information. In many cases, the fraudsters can refer the consumer to public records available from trusted sources (for example, the bank's website or the Securities Exchange Commission) that prove the audit firm they claim to represent is, in fact, the auditor of the bank. To pressure the consumer to provide the information, the fraudster can point to requirements in the Proposal. For example, paragraph 16 of the Proposal, the fraudster can justify why the consumer must provide the information to the fraudster, rather than merely confirming information the fraudster is providing to the consumer. This simple example demonstrates why the PCAOB should consider these implications in its rulemaking.

Download the comment letter to read the full text.