Audit Confirmations: Confirmation.com vs Email vs AI Agents

By Jude Lee · November 3, 2026 · Comparison

Two auditors reviewing an accounts receivable aging and confirmation tracking list on a laptop in a CPA firm conference room

What “automation” actually means in a confirmation workflow

When people ask what automation in accounting is, they usually picture one of three different things. First, rules: deterministic steps a system runs the same way every time (a portal that emails a reminder on day 7). Second, platforms: software that owns a whole workflow end to end (a confirmation intermediary that routes bank requests to participating institutions). Third — new, and the subject here — agents: an AI assistant that can read your files and systems, carry out multi-step tasks, and produce work product, with a human approving what matters.

Confirmations are a good test case because the job splits cleanly. Most of the elapsed time is coordination: picking the sample, finding the right contact, assembling a packet, chasing non-responders, logging what came back, reconciling differences, documenting the conclusion. Very little of it is judgment — but the judgment parts are non-delegable.

The control requirement that shapes every option

Under AICPA AU-C Section 505, External Confirmations, the auditor is required to maintain control over external confirmation requests — including determining the information to be confirmed, selecting the confirming party, designing the request, and sending and receiving responses directly. For issuer audits, the PCAOB’s AS 2310, The Auditor’s Use of Confirmation, replaced the older standard and became effective for audits of financial statements for fiscal years ending on or after June 15, 2025; it addresses, among other things, the use of intermediaries and the auditor’s responsibilities when responses are received electronically. Standards and effective dates move, so confirm the current text and applicability directly with the AICPA and PCAOB rather than relying on summaries — including this one (written as of 2026).

The practical translation: anything that sits between you and the confirming party is something you have to evaluate and document. That is true of a confirmation platform, and it is equally true of an AI agent with mailbox access.

Platform vs manual: what each actually buys you

Confirmation intermediary platform

Strongest fit for bank and cash confirmations, where some institutions decline paper requests and route everything through a participating platform — check each institution’s published confirmation policy rather than assuming. You get identity verification of responders, a timestamped trail, and a central status view. Costs are typically per-confirmation or subscription-based, and coverage varies by institution and by confirmation type — AR customers and law firms are often still outside the network. You also have to evaluate the intermediary and document that evaluation; concrete inputs include the platform’s SOC 1 or SOC 2 report and its complementary user-entity controls, how responders are authenticated and provisioned at each institution, the institution-by-institution coverage list for the confirmation types you actually send, and the contractual terms on data retention and subprocessors.

Email and mail, run by the team

Maximum flexibility and no per-item fee, which is why it survives for receivables, related-party, inventory-held-by-others, and attorney letters. The cost is clerical: contact hunting, packet assembly, second and third requests, and a tracking spreadsheet that goes stale. Authenticity risk is higher — an emailed reply from an address the client supplied is exactly the scenario the standards tell you to think hard about.

Most firms run both, which is why the real pain is not the sending mechanism. It is the two tracking systems, the stale status spreadsheet, and the partner asking on Thursday who is still outstanding.

Where an AI agent genuinely earns its place

Think of the agent as a staff-level preparer that never forgets the log. Connected to your document management and trial balance through MCP — the open protocol for giving an assistant governed access to specific systems and tools — it can work inside the engagement file rather than in a separate silo. Our walkthrough of read-only versus write access for accounting agents applies directly here: confirmations are a read-heavy, draft-output job.

Build the population and selection schedule

Agent pulls the AR aging and the bank/loan listing from the trial balance, applies the sampling parameters the senior sets, flags related parties and unusual terms, and outputs a selection workpaper for review. The auditor approves the selection — that is a judgment, not an output.
Assemble request packets

Agent drafts each confirmation from the firm template, populating balance, date, and contact details, and flags any record where the contact came from an unverified source so the team can verify it independently. Carve legal representation letters out of this step entirely: attorney letters follow their own protocol, are negotiated with counsel and management, and should be drafted and reviewed by the engagement team, not an agent.
Run the chase log

Agent maintains one status view across the platform-routed items and the manual ones, drafts the second and third request text on the firm’s cadence, and posts a daily outstanding list to the engagement channel. A human sends.
Match responses to the ledger

Agent reads returned confirmations, extracts confirmed balances, compares to the recorded amount, and classifies: agreed, exception, non-response. It drafts the reconciling-item analysis using subsequent cash receipts and open invoices.
Draft the memo, then stop

Agent produces the exception summary and proposed alternative-procedures documentation. The engagement team evaluates authenticity, sufficiency, and conclusions, and signs.

The same packaging logic from skills for workpaper prep from a trial balance works well here: write the confirmation procedure once as a reusable skill so every engagement produces the same workpaper structure, tick marks, and memo format — with the same mandatory review gate before anything leaves the file.

Agents are excellent at the chase log and terrible at deciding whether a response is authentic. Automate the first; never outsource the second.

Vet where the data goes before it reaches a model

An AR aging is a list of your client’s customers, contacts, and credit exposure; a bank confirmation carries account numbers. Before any of it crosses into an AI tool, map the path: which provider processes the prompt, whether inputs are used for model training, how long they are retained, which subprocessors and regions are involved, and whether the deployment option you chose (enterprise tier, zero-retention endpoint, private hosting) actually changes those answers in the contract rather than the marketing page. Then check the other side: the AICPA Code of Professional Conduct’s confidential client information rule governs disclosure to outside service providers, and many firms address third-party processing in engagement letter language or a separate client consent. For firms that also handle tax data, IRS Publication 4557, Safeguarding Taxpayer Data, is the baseline reference for written security plans. Have your firm’s risk or legal counsel confirm what your engagement letters and state board rules require before you connect anything live.

Where it breaks

Extraction from scanned, handwritten, or bank-letterhead PDFs is imperfect — treat every extracted balance as a draft that a human ties out. Agents will also happily invent a plausible reconciling item if the data is thin; that is the single highest-stakes failure mode in this workflow, and it is why the review gate matters more than the speed gain. If your confirmation volume is small and already routed through a platform, an agent may add governance overhead for little return. Rules-based reminders in your existing portal might be the whole answer.

Modeling the payback with your own numbers

Don’t take anyone’s published savings figure — including the illustration below, which uses made-up inputs purely to show the arithmetic. Say an engagement sends 40 confirmations, and say packet assembly, chasing, and logging take 12 minutes per item across the cycle: that’s 8 hours of clerical time (40 × 12 ÷ 60). Multiply by the blended rate of whoever actually does that work today, then subtract platform fees plus the time to write and maintain the skill. Pull your real item count and time-entry minutes before you decide anything.

Illustrative confirmation count for one engagement — substitute your own

8–15 min

Example per-item clerical range to test against your time entries

hours × rate

The only formula that matters: your measured hours at your blended rate, less fees and build time

Then add the part firms forget: recovered senior hours have a second value if they move to review or chargeable advisory work rather than evaporating. Plug in your own realization rate; if the recovered hours just absorb overtime you weren’t billing, the honest answer is that the benefit is capacity and sanity, not revenue.

What changes in the staffing mix

Confirmations illustrate why agents don’t displace auditors. The standards assign responsibility for controlling the process, evaluating response reliability, and concluding on sufficiency to the auditor personally. An agent that drafts faster doesn’t inherit that responsibility; it just gives the auditor more time to exercise it. What does change is the mix: fewer staff hours on contact hunting and status spreadsheets, more on judgment, exceptions, and review. Firms hiring for automation roles are generally hiring people who can encode firm procedure into repeatable skills — not people who can click faster.

A reasonable sequence

Keep the platform for bank confirmations. Keep humans on send and receive. Add an agent, read-only at first, over the aging and the engagement file to produce the selection workpaper and the chase log. Measure error rate against a sample you check by hand before you trust the matching step. If the drafts hold up over a full busy season, extend to the exception memo — and document how you evaluated the tool, because someone in peer review will ask.

Not sure where to start?

Get a free automation audit: we map your bookkeeping, month-end close, client onboarding, document collection, and AP/AR — and show you what's worth automating before you spend a dollar.

Get a free automation audit