Is a Bank Statement Sufficient Audit Evidence?

Last updated July 2026.

Quick answer: A bank statement is audit evidence, but a client provided copy is lower quality than a confirmation obtained directly from the bank, because the client controls it. Under AU-C section 505, external confirmation is the stronger procedure. Where inherent and control risk over the existence of cash is assessed as low, inspecting client provided statements can be an appropriate substantive procedure, and the auditor documents why.

Why the source matters more than the document

Audit evidence is judged on relevance and reliability, and reliability depends heavily on where the evidence came from. Evidence obtained directly from an independent external source outranks the same information supplied by the client, because the client had the opportunity to alter it in between. That is the entire reason bank confirmations exist. The information on a confirmation and the information on a statement can be identical. The chain of custody is not.

This is not a theoretical concern. Falsified bank statements appear regularly in fraud cases, and modern editing tools make a convincing forgery cheap to produce. A PDF that arrived by email from the client is exactly as trustworthy as the client, which is precisely what an audit is not supposed to assume.

What AU-C 505 requires

AU-C section 505 covers external confirmations. The procedure involves selecting the items to confirm, sending the request directly to the confirming party, and evaluating what comes back, including how you handle nonresponses. The key structural feature is directness in both directions: you send it, and the reply comes to you, without the client in the middle.

The standard is under active revision. The AICPA Auditing Standards Board issued an exposure draft proposing amendments that would require auditors to document their rationale for not using external confirmation procedures for cash and accounts receivable when the exceptions apply, regardless of materiality. The direction of travel is clear: not confirming is becoming a decision you have to justify in the file rather than a default you can leave unexplained. Check the current status of the standard before relying on the specifics, since this is a moving target.

When is inspecting the bank statement enough?

There is a recognized path where substantive procedures over cash can be limited to inspecting client provided bank statements: when the combined assessed level of inherent and control risk over the existence of cash is low. That is a genuine option, not a shortcut, and it carries conditions.

The assessment has to be supported. Low control risk means you have identified and tested the relevant controls, not simply formed an impression that the client seems well run. Low inherent risk over cash existence is a harder argument than it sounds, because cash is liquid, easily transferred, and the account most often targeted in misappropriation. In many engagements, particularly smaller entities with limited segregation of duties, that combination will not be supportable, and confirmation remains the answer.

How to strengthen a client provided statement

If you are relying on statements the client gave you, a few procedures materially improve what that evidence is worth.

• Foot the activity. Total the transaction detail and agree it to the deposits and withdrawals summary printed on the statement. A hand edited figure usually fails this.
• Check the running balance line by line. Each balance should equal the prior balance plus or minus the transaction amount. Edits break the chain.
• Roll the months forward. Each month closing balance should equal the next month opening balance across the entire period.
• Inspect the file properties. A statement downloaded from a bank portal has different metadata and structure than one that has been through an editor.
• Consider direct access. Some banks provide read only auditor access or third party verification services, which restores the direct chain of custody without a paper confirmation.

The first three checks are arithmetic and take minutes once the transactions are in rows rather than locked in a PDF, which is the practical case for converting statements before testing them. The bank statement converter for auditors covers that workflow, and how to convert a bank statement for audit covers the mechanics.

Does converting a statement affect its evidential status?

No. Conversion reformats the same information into rows. It does not upgrade a client copy into a confirmation, and it does not degrade a statement obtained directly. What it changes is how thoroughly you can test whatever you have, which is why converted statements often turn up problems that a page by page read would miss. Keep the original PDF in the workpaper as support for the converted sheet, and document the conversion the same way you would document any other data extraction step.

Bank statements and the proof of cash

Where fraud risk over cash is elevated, a proof of cash does more work than a standard bank reconciliation. It agrees beginning balance, receipts, disbursements, and ending balance between the bank and the books, so it catches offsetting errors that leave the ending balance intact. A deposit recorded twice alongside a payment recorded twice reconciles perfectly on the closing balance and fails immediately on the activity columns. The proof of cash template for Excel covers the format, the formula, and a worked example.

What about cash intensive businesses?

Where a large share of revenue arrives as currency, the bank statement is evidence of what was deposited, not of what was earned. That gap is the whole risk. Skimming happens before the deposit, so no amount of statement testing detects it directly, and you need procedures aimed at the gap itself: analytical review against industry margins, comparison of deposits to point of sale records, and testing the controls over cash handling. What triggers a cash intensive business audit covers the risk indicators.

Practical summary

Treat a client provided bank statement as real but second tier evidence. Confirm cash directly when the risk assessment does not clearly support relying on inspection alone, and document the reasoning either way, because that documentation expectation is tightening. When you do rely on client statements, do the arithmetic checks rather than just filing the PDF. For adjacent work, forensic accounting bank statement analysis covers investigative engagements, three way trust account reconciliation covers law firm trust accounts, and bank statement CSV for CPAs covers general client file prep. Engagement teams also testing expense and vendor populations often pair statement work with automated receipt and card spend capture so the supporting documents arrive already coded rather than as another folder of PDFs.