Audit confirmation letter redaction is the removal of third-party personal data from a confirmation. ISA (UK) 505 requires the auditor to keep control of the confirmation process. Under para. 7 the auditor decides what to confirm, picks the confirming party, designs the request, and sends it. The reply then joins the file governed by ISA (UK) 230. anonym.plus marks each identifier on your device, so the confirmed balance stays.
When this applies
A bank or customer confirmation names a contact, an account, and a balance. Companies Act 2006 s.499 gives the auditor access to the company's books, accounts, and vouchers, and s.500 extends that to UK subsidiaries. You strip the contact and account before the letter circulates beyond the binder.
How anonym.plus handles it
- Open the letter in anonym.plus on your device.
- Built-in OCR reads a scanned, signed reply.
- The app marks the contact name and account line.
- Keep the confirmed balance and date intact.
- Replace or mask the confirmed identifiers.
- Save the clean letter locally.
What you need to provide
- The confirmation (PDF, scan, or DOCX).
- An operator (Replace keeps the reply readable).
- Optional batch for a folder of replies.
PII & financial identifiers detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | bank officer Peter Lund → [CONTACT] |
| Financial | UK_BANK_NUMBER | confirmed acct 7782 → [ACCOUNT] |
| Sort code | UK_SORT_CODE | 40-12-19 → [SORT] |
| Contact | EMAIL_ADDRESS | p.lund@example.co.uk → [EMAIL] |
| Org | ORGANIZATION | First Bank plc → [BANK] |
| Money | MONEY | balance £96,000 → [AMOUNT] |
Compliance achieved
- Supports the auditor's control of the confirmation process under ISA (UK) 505 para. 7.
- Keeps the confirmed figure and date that make the reply evidence, plus the identifying characteristics ISA (UK) 230 para. 9 requires.
- Reflects the auditor's statutory access to books, accounts, and vouchers under Companies Act 2006 s.499, extended to subsidiaries by CA 2006 s.500.
- Strips third-party contacts while the confirmed figure stays. Offline work keeps the reply inside your practice.
Anonymise confirmation letters offline — see plans & start free →
Limitations & cautions
ISA (UK) 505 also asks the auditor to weigh whether a response is reliable, including how it arrived and who sent it. Removing the responder's identity from the retained file can undercut that judgement, so redact the copy you circulate instead. The app marks identifiers, not evidence value.
Frequently asked questions
Can it read a scanned, signed reply?
Yes. On-device OCR reads the image, then marks the contact, email, or account on the page so you can clear it.
Will the confirmed balance survive?
Yes. Allow-list the balance and date. Only the contact and account data are marked, so the reply still supports the assertion tested.
Should the responder's name stay on the retained file?
Usually yes. ISA (UK) 505 requires the auditor to control who is asked and to judge whether a reply is reliable, and ISA (UK) 230 para. 9 requires the identifying characteristics of what was tested. Redact the circulated copy, not the retained binder.