Audit Assertions Explained: A Bank Executive's Guide

Audit assertions are management's implicit or explicit representations about how financial-statement information is recognized, measured, presented and disclosed, organized into five categories: existence or occurrence, completeness, valuation or allocation, rights and obligations, and presentation and disclosure.

A bank can reconcile a dashboard perfectly and still lack evidence that its assets are recoverable or its obligations are complete. For directors, the central question isn't whether management can reproduce a number. It's whether management can demonstrate the particular claim that number makes.

The Five Audit Assertions Every Bank Should Know

Audit assertions convert financial reporting into testable management claims. The PCAOB's AS 1105 organizes those claims into five foundational categories and connects them to the evidence auditors must evaluate.

The five audit assertions and the risk each guards against

Assertion	Question It Answers	Risk If Missed
Existence or occurrence	Do recorded assets and liabilities exist, and did recorded transactions occur?	Overstated balances
Completeness	Is everything that should be recorded actually recorded?	Hidden obligations and understated exposure
Valuation or allocation	Are amounts recorded at appropriate values?	Loans carried above expected recovery
Rights and obligations	Does the bank control its assets and owe its liabilities?	Participated or pledged assets reported as fully owned
Presentation and disclosure	Are items classified, described and disclosed correctly?	Misclassified delinquent loans or missing concentration disclosures

Existence or occurrence separates a recorded position from an actual asset, liability, or transaction. For banking executives, a balance remaining in the servicing system isn't enough to establish that the underlying exposure remains outstanding.

Completeness asks the reverse question: what should be recorded but isn't? A clean reconciliation of recorded accounts won't necessarily identify a commitment omitted from both systems.

Valuation or allocation addresses the amount, not merely the presence, of an exposure. Borrower deterioration can undermine an otherwise well-documented loan balance.

Rights and obligations requires evidence of the bank's contractual position. Servicing an asset, holding documentation, and owning the economic interest aren't interchangeable.

Presentation and disclosure determines whether readers receive the right description and classification. Correct totals can still conceal incorrect delinquency categories or incomplete concentration information.

What directors should demand

Every material dashboard figure should have an identifiable assertion behind it. That doesn't mean every figure requires identical procedures across every category. It means management should explain what the figure establishes and what remains untested.

When a number is challenged, first ask which assertion management believes the evidence supports.

This distinction turns board oversight from a discussion of reporting accuracy into a discussion of financial risk.

Mapping Assertions to a Bank's Balance Sheet

A balance-sheet figure supports only the assertions its underlying records can establish. For a hypothetical $2.0 billion bank, consider $900.0 million in commercial real estate loans, $40.0 million in unfunded commitments, and a $15.0 million allowance for credit losses. The relevant-assertion approach in PCAOB AS 2201) focuses attention on assertions where a material misstatement could occur.

Assertions and test focus for a hypothetical $2.0 billion bank

Account	Balance	Primary Assertions	Test Focus
Commercial real estate loans	$900.0 million	Existence, completeness	Loan agreements, borrower confirmations, servicing records
Unfunded commitments	$40.0 million	Completeness	Commitment register reconciled to the loan system
Allowance for credit losses	$15.0 million	Valuation	Collateral values, borrower cash flow, modification history
Participations and pledged collateral	Contractual interest and pledged amount	Rights and obligations	Participation agreements and lien filings
Concentration and risk classification disclosures	Applicable portfolio totals	Presentation and disclosure	Classification workpapers tied to the call report

The map guides testing; it does not assign a fixed level of risk to each account. For example, loan agreements and servicing records may support the recorded loan population, while collateral values and borrower cash flow bear more directly on whether the allowance is reasonable.

Unfunded commitments call for a different view of the balance sheet. Their $40.0 million is not outstanding loan principal, so a test limited to funded balances would not establish whether the commitment population is complete.

Allocate effort by exposure, not habit

A reconciled portfolio can still carry valuation risk. Volatile property values, stale borrower financial statements, or unresolved collateral exceptions can weaken the evidence supporting the allowance.

Directors should distinguish account size from assertion vulnerability. A large balance warrants attention, while an uncertain estimate or legally complex position may require more judgment than a larger, straightforward balance.

Ask management to identify the fields supporting each conclusion: borrower identifier, outstanding principal, commitment amount, collateral date, risk grade, ownership percentage, and reporting classification. Missing or inconsistent fields need an assigned owner.

Which fields support each relevant assertion, and who owns each exception? An account-level owner without an assertion-level explanation leaves the board unable to assess what the reported figure establishes.

Testing Existence and Completeness in Loans and Deposits

Start existence testing with recorded balances

Select recorded loans and trace them to executed agreements, borrower confirmations, and servicing records. For deposits, compare customer statements, core-system outputs, and the ledger, while checking that the records describe the same customer, balance date, and account status.

Check transaction dates separately. A valid account doesn't establish that every transaction attributed to the reporting period occurred during that period.

Look specifically for loans booked to closed or paid-off accounts, duplicate records, and charged-off amounts still carried as outstanding assets. These are existence or occurrence exceptions, not merely reconciliation differences.

The distinction matters in a hypothetical $100.0 million commercial-loan portfolio: confirmed sampled borrowers may support existence while understated expected credit losses undermine valuation, consistent with the assertion framework in the PCAOB auditing standards compilation.

Test completeness from source records into the books

Reconcile the general ledger with subledgers, servicing platforms, acquisition records, and the commitment register. Trace source obligations into the reporting population rather than limiting testing to accounts already present.

Include purchased participations, unfunded commitments, related liabilities, and acquired loan portfolios. Correct valuation of recorded accounts doesn't resolve an omitted exposure.

Maintain a short exception register:

• Unsupported balances: Recorded amounts without adequate underlying evidence.
• Unrecorded obligations: Source commitments or liabilities absent from the reporting population.
• Late postings: Transactions requiring a reporting-period determination and documented disposition.

A confirmation sent isn't an existence result

The PCAOB's revised confirmation standard, applicable to audits of years ending on or after June 15, 2025, establishes a presumption of directly accessing information maintained by a knowledgeable external source when feasible and prohibits negative confirmations alone as audit evidence.

Electronic intermediaries, spam filters, and low response rates complicate the process. Auditors must evaluate who controlled the response and whether the respondent was knowledgeable and independent.

Suppose 300 confirmations sent against a $900.0 million portfolio produce 120 responses. The remaining 180 nonresponses require appropriate follow-up or alternative evidence, such as executed agreements and verified servicing records, before reaching an existence conclusion for the affected items.

Existence testing challenges what is recorded. Completeness testing searches for what is missing. Neither conclusion should be inferred from the other.

Valuation, Rights and Presentation Tests for Bank Reporting

Valuation requires current economic support

Run a recoverability and allowance-input test. Compare expected cash collections with current borrower financials, collateral information, modification history, and contractual terms, then assess whether the allowance methodology incorporates those conditions appropriately.

A hypothetical $10.0 million loan exposure isn't necessarily worth $10.0 million, and a $75.0 million participation asset requires evidence of the contractual interest rather than an open system entry, applying the mechanics illustrated in the PCAOB's archived audit-evidence guidance.

The allowance account in the balance-sheet map should therefore lead to underlying exposure-level support, not just a model total. Assign the chief credit officer responsibility for borrower-condition inputs and the finance executive responsibility for the recorded estimate.

Set an escalation threshold for stale support, unexplained model overrides, and differences exceeding the bank's approved financial-reporting tolerance. These are proposed control criteria, not universal regulatory thresholds.

Rights testing follows the contract

For participations, perform a contractual-interest test: reconcile ownership percentages, payment allocations, recourse terms, and outstanding balances to the agreement. For collateral, have the responsible legal or collateral-administration team verify lien documentation, perfection, priority, and applicable exceptions.

Pledging an asset doesn't automatically mean the bank must stop recognizing it. The reporting question is whether management has correctly established ownership, encumbrances, obligations, and required disclosures.

Search outside the primary loan system for acquired funding obligations and other contractual liabilities. Escalate any unsupported ownership interest or unresolved lien defect rather than allowing an operational status code to stand in for legal evidence.

Presentation testing follows the reporting rules

Use a classification-to-report test to trace delinquent assets, modified loans, concentrations, and risk grades from source records through classification workpapers to the call report and applicable financial-statement disclosures.

The controller should own reporting classifications, with credit administration validating underlying credit attributes. Modification labels must follow the accounting requirements applicable to the reporting period, not an unchanged legacy system description.

Define exceptions as unexplained mapping differences, missing required disclosures, or unsupported classification overrides. Organize escalation around the underlying defect:

• Valuation gaps: Economic evidence doesn't support the recorded amount.
• Rights shortfalls: Contractual interests or collateral rights remain unsupported.
• Classification breaks: Source conditions don't match reported categories.

These labels help directors request a specific remedy rather than a general assurance that reporting has been reviewed.

Matching Audit Evidence to Each Assertion

Evidence sources and the assertions they support or fail to support

Evidence Source	Strongest For	Weaker For
Executed loan agreements and servicing records	Existence, rights and obligations	Completeness of unrecorded obligations
Borrower or third-party confirmations	Existence	Valuation of collateral and expected losses
Internal management reports	Completeness and reconciliation	Existence on its own
Historical delinquency data	Indirect support for valuation	Current condition of specific exposures
Current collateral appraisals and borrower cash-flow updates	Valuation of specific exposures	Completeness of the population
Regulatory call report figures	Presentation and disclosure	Existence of individual loans

Evidence must be reliable and relevant to the assertion being tested, according to PCAOB audit-evidence guidance. For example, an internal report showing a $250.0 million loan balance may support reconciliation but is weaker evidence of existence than independent borrower confirmations or appropriately verified underlying records.

The reverse problem is equally important. Confirming sampled borrowers doesn't establish that management captured every obligation or commitment.

Historical delinquency data can inform expected-loss analysis, but specific exposures may require current collateral values, borrower cash-flow updates, and modification history. The strongest evidence answers the actual question, not a nearby one.

Test the provenance as well as the content

Ask management to reproduce the path from source record to conclusion. The supporting package should preserve timestamps, transformation logic, population definitions, and exception history.

A spreadsheet may contain accurate figures while lacking enough lineage to explain exclusions or adjustments. Likewise, several reports generated from the same underlying extract aren't independent corroboration.

Practical rule: More reports don't necessarily mean more evidence. Determine whether they add a distinct source or merely repeat the same assertion.

A report on internal control over financial reporting should be read with that distinction in mind: control conclusions need defined scope and supporting work, not just a reporting output.

As a board oversight convention, seek at least two independent sources for each relevant assertion where feasible. That isn't a substitute for professional judgment or a prescribed audit-evidence minimum; it is a useful challenge against single-source dependence.

Documenting Contradictory Evidence and Assertion Trails

A credible assertion program searches for evidence that could disprove management's conclusion. A process designed only to confirm expected results leaves directors unable to distinguish a sound conclusion from selective support.

ISA 500 audit-evidence guidance recognizes that evidence can support or contradict management's assertions and that independent information can be useful. The auditor must still obtain sufficient appropriate evidence to reach a reasonable conclusion.

Treat contradictory signals as questions, not verdicts

Loan balances growing while interest income falls warrants an occurrence and valuation inquiry. Management should identify the affected population, test origination and repricing dates, examine nonaccrual status, and reconcile income recognition before concluding that the pattern reflects a reporting error.

Reserves remaining flat while delinquency rises calls for an allowance-valuation review. Preserve the delinquency population, model version, segmentation changes, borrower updates, and management overlays supporting the reserve conclusion.

Reported margins diverging from peer benchmarks should prompt a classification and measurement check. Record the peer-selection criteria, balance-sheet mix, reporting period, and adjustments before treating the divergence as evidence of a defect.

Each pattern can have a legitimate explanation. The governance failure occurs when management dismisses the signal without retaining the evidence behind that explanation.

Cross-system reconciliations should compare the ledger, subledgers, servicing platforms, regulatory reports, and transaction feeds. Log duplicate accounts, unsupported overrides, late postings, and unexplained breaks against the affected assertion.

Build a repeatable assertion trail

Use the following six-step documentation sequence as an operating template:

1. Name the assertion and account. State the exact claim under review. A generic loan-review label obscures whether the work addresses existence, valuation, or another risk.
2. Define the population and source system. Preserve inclusion rules and reconciliation totals. A sample drawn from an unreconciled population can't establish what management believes it covers.
3. Record the procedure and sample size. Explain selection logic, timing, and scope. A list of reviewed accounts without the selection method isn't a reproducible test.
4. Log evidence and exceptions. Retain source documents, analytical outputs, and contradictory findings. An alert loses explanatory value if its transformation history disappears.
5. Record the conclusion and unresolved risk. Separate supported findings from assumptions and pending responses. Closing a ticket doesn't necessarily resolve an assertion.
6. Capture the preparer, reviewer, and review date. Identify who performed and challenged the work. An undated review prevents a reader from determining which evidence was available at sign-off.

The documentation discipline is consistent with the assertion-focused approach established by PCAOB Auditing Standard No. 15. Preserve procedures, evidence, conclusions, and responsibility as connected records rather than scattered attachments.

Don't turn missing information into a neutral result

Management's refusal to provide requested information or representations belongs in the record as a potential limitation or contradiction. Escalate the missing evidence and explain which conclusion remains unsupported.

A durable audit trail connects each alert to its tested assertion, source records, transformation history, reviewer disposition, and unresolved risk. That lets a subsequent reviewer understand the conclusion without reconstructing the analysis.

An exception isn't resolved because someone supplied an explanation. It's resolved when the explanation is supported and the remaining risk is explicitly assessed.

For directors, this is the difference between receiving a status update and receiving a defensible conclusion.

Quick Reference for Board Questions on Assertions

A dashboard figure supports only the assertion its evidence tests. Directors should ask what each figure establishes, then request evidence that addresses that specific claim.

Board questions, the assertion they test and the evidence to request

Board Question	Assertion	Evidence to Request
Do dashboard loan totals tie to the general ledger and signed agreements?	Existence	Loan agreements and servicing reconciliation
Is the commitment register complete?	Completeness	Commitment listing reconciled to the loan system
Is the allowance supported by current collateral and cash flow?	Valuation	Collateral appraisals and borrower updates
Does the bank own its participations and hold perfected liens on pledged collateral?	Rights and obligations	Participation agreements and lien filings
Are delinquent and modified loans classified correctly?	Presentation and disclosure	Classification workpapers tied to the call report
Were late postings and overrides reviewed?	Completeness and existence	Posting logs with reviewer sign-off and date

Judge the answer, not the presentation

A reconciliation shows whether records agree. Loan agreements provide evidence about whether recorded exposures exist. The loan-total question therefore tests two related claims, and a tie-out alone does not support both.

For each answer, identify the claim being tested and whether the evidence directly supports it. A commitment listing reconciled to the loan system addresses completeness; it does not by itself establish the rights and obligations attached to each commitment. Likewise, collateral and borrower information may inform an allowance estimate, but the board should ask how that evidence supports the reported value.

Board composition matters when directors must challenge accounting estimates and reporting controls, so confirm that audit committee members have enough accounting and credit expertise to test each assertion. Institutions considering board placement for CFOs and audit chairs can use that expertise requirement as a governance consideration.

Keep the same six board questions on the recurring oversight agenda. Compare the evidence and unresolved exceptions period by period, not just the presentation format.

Confirm Your Assertion Map Before the Next Audit Cycle

Map every major portfolio and disclosure to its relevant assertion, evidence source, owner, and exception threshold before the next audit cycle. Begin with the three highest-balance accounts, then extend the map to significant estimates, off-balance-sheet exposures, and disclosures.

• Assign the claim. Name the primary assertion and identify other assertions made relevant by the account's risks.
• Validate support. Seek corroboration from two independent sources, documenting where independence or coverage is limited.
• Own the breach. Set an account-specific exception threshold and name the executive responsible for escalation and resolution.

Make the map usable between audits

A governed data layer should connect call-report information with loan-level, collateral, and macroeconomic inputs while preserving quality checks and version history. External intelligence can identify where to investigate, but it doesn't replace the bank's underlying contractual and accounting evidence.

Visbanking unifies public and proprietary sources into a consistent model with entity resolution, quality checks, and version control. Our executive dashboards, annotated charts, and export-ready reports support period comparisons, while customers can benchmark banks and credit unions side by side with a couple of clicks.

Use that context to decide whether an unusual pattern warrants institution-specific investigation or broader portfolio analysis. Bring the resulting questions into your bank audit preparation, with an owner and evidence request attached, rather than leaving them as dashboard observations.

---

Visbanking offers bank intelligence, peer comparisons, and traceable reporting to help leadership identify where an assertion needs closer examination. Visit Visbanking to benchmark your institution and explore the data behind a more defensible assertion map.