Bank statements as audit evidence are fairly reliable because a bank, not the client, produces them. That reliability weakens when the client delivers the statement, since a PDF can be edited on the way. Statements the auditor obtains directly, through the bank, a confirmation or read-only access, are stronger, and higher-risk audits should use them.
How reliable are bank statements as audit evidence?
Bank statements are moderately strong audit evidence. They come from an independent third party, they are produced by systems the client does not control, and they record every movement through the account. Their weak point is the route. A statement that passes through the client before it reaches the auditor is only as reliable as that handling.
Think of reliability as three questions. Who created the document? A bank, which has no stake in the client's results. Who handled it after creation? Often the client, who does. In what form did it arrive? A paper original, a bank-generated PDF, a scan, or a spreadsheet the client typed up, each a step further from the source.
A statement scores well on the first question and can score poorly on the other two. That is why two auditors can look at the same December statement and draw different comfort from it. One downloaded it from the bank portal with the client watching. The other received it as an email attachment a week after asking.
Relevance is a separate test. A reliable statement is still the wrong evidence for some claims. It shows that cash moved through an account in the client's name, but not who may use the money or whether the bank has a claim on it. The last section covers those limits.
Client-supplied bank statement PDFs versus statements the auditor obtains
A client-supplied bank statement PDF is a file the client downloaded or scanned and then sent to the auditor. A statement the auditor obtains comes from the bank without passing through client hands. The content may be identical, but only the second route rules out alteration in between, so it carries more weight.
PDF statements are easy to change. Editing tools can alter a balance, remove a line or shift a date, and a careful edit leaves no visible trace on the page. Most clients would never do this. The point is that the auditor cannot tell from the file alone, so the evidence carries whatever trust the auditor places in the client.
Scanned paper statements have their own issues. A scan is a copy, and copies are weaker than originals. Poor scans also cause reading errors, so a 3 can become an 8 and a line can drop out. That is a quality problem, not fraud, but it still produces wrong evidence.
Spreadsheets and accounting-system bank feeds are a step further removed. A bank feed in the ledger is data the client's software imported and then let users change, match and delete. Treat it as client records about the bank, not as the bank's record.
PCAOB guidance on external information that reaches the auditor through the client
PCAOB staff guidance says information the auditor obtains directly is, in general, more reliable than information obtained indirectly. A 2024 amendment to AS 1105 adds a duty, for issuer audits, to evaluate external electronic information the company provides. A client-emailed bank statement PDF fits that description.
The PCAOB staff guidance on evaluating the relevance and reliability of audit evidence from external sources, issued in October 2021, lists factors that affect reliability. One is whether the auditor got the information directly; another is whether it was corroborated through more than one source. The document says it represents the views of PCAOB staff and is not a rule of the Board.
The newer requirement is paragraph .10A of AS 1105. As quoted in PCAOB Release No. 2025-004, the Board's policy statement on implementing paragraph .10A, the auditor should understand the source of external electronic information the company provides and the company's process for receiving and keeping it. The auditor should then either test whether the company modified it or test the controls over it. The release states the amendments apply to fiscal years beginning on or after December 15, 2025. Its footnote gives cash receipts, shipping documents and purchase orders as examples, not bank statements. A statement the client downloaded and emailed has the same features, though, so many firms will apply the same thinking to it.
The release also says that, depending on risk and the results of other procedures, separate testing may not be needed. It says the Board will not treat its absence as noncompliance when the auditor concludes there is no more than a remote possibility of a modification that would make the information unreliable. That conclusion still has to be reached and documented.
A reliability ladder for bank statement evidence
The reliability of a bank statement rises with each step that takes the client out of the delivery path or adds a second source. The table below ranks six common routes. The ranking is a general guide, not a rule from any standard, and a firm's methodology may order them differently.
| Route | What it proves | Extra step that strengthens it |
|---|---|---|
| 1. Spreadsheet or ledger bank feed from the client | What the client recorded about the bank | Agree to a bank-produced statement |
| 2. Scanned paper statement emailed by the client | A copy of what the bank printed, legibility permitting | Compare balances to a confirmation |
| 3. Bank-generated PDF emailed by the client | The bank's statement, if unaltered | Foot it, check continuity, agree the closing balance to a confirmation |
| 4. PDF downloaded by the client while the auditor watches | The bank's statement, with the route observed | Record the date, user and screens viewed |
| 5. Read-only online access granted to the auditor | The bank's live records for the account | Download the statements yourself; save the access log |
| 6. Statement or confirmation sent by the bank straight to the auditor | The bank's record, no client handling | Agree it to the reconciliation and the ledger |
Most audits mix routes. A common pattern is to take the client's PDFs for every month, agree the year-end balance to a confirmation, and obtain the month after year end straight from the bank as a cutoff statement. Each month then has internal checks, and the two dates that matter most have outside support.
Arithmetic adds a check at every level. A statement whose opening balance, activity and closing balance agree, and whose closing balance carries forward to the next month, is harder to have altered than one that has not been tested. The tie between each reconciliation claim and the procedure behind it is set out under which assertions a bank reconciliation tests.
When should the auditor obtain bank statements directly?
The auditor should obtain bank statements directly when the risk of misstatement in cash is higher than normal or when something about the client's statements looks wrong. Signals include fraud risk factors, a weak control environment, delays in providing statements, statements that do not foot, and accounts at banks the auditor has not dealt with before.
Risk signals that call for going to the bank
- The client is slow or selective. Statements arrive late, arrive for some months only, or arrive as scans when the bank offers PDFs.
- The numbers do not hold together. A statement does not foot, a closing balance does not carry forward, or a balance disagrees with the confirmation.
- One person controls cash. The same employee handles receipts, payments, the bank portal and the reconciliation.
- Pressure is high. The client is near a covenant limit, raising money, or being sold.
- The account is unusual. A new bank, a foreign bank, or an account with large round-number transfers.
Accounts that need extra care
Foreign accounts raise both access and translation questions, and banks outside the country may answer confirmations slowly or not at all. Auditing foreign bank accounts and currency balances covers how to get evidence in those cases.
Lockbox accounts, where a bank collects customer payments and passes on a file, add a second bank-produced record: the lockbox report. Comparing that report to the deposits on the statement is strong evidence because both come from the bank, as described in lockbox reconciliation from bank file to receivables.
What bank statements as audit evidence cannot prove
Bank statements as audit evidence cannot prove that the client is free to use the cash, that no other accounts exist, or that the bank holds no claim against the balance. They show activity and a balance in one account. Restrictions, liens, compensating balances and undisclosed accounts need other evidence, usually a bank confirmation and a review of agreements.
Restrictions are the common gap. A balance held as collateral for a loan, pledged to a letter of credit or kept in escrow looks the same on a statement as free cash. The loan agreement and the confirmation reply reveal it, and the disclosure question is covered in the restricted cash audit, finding and disclosing it.
Completeness of accounts is another gap. A set of statements proves only the accounts it covers. It cannot show an account the client did not mention. A confirmation that asks the bank to list every account in the client's name, and a scan of statements for transfers to unfamiliar account numbers, help close that gap.
Ownership needs care too. The name on a statement is usually the client entity, but an account in an owner's or officer's personal name can still hold company money. Read the account title on every statement, not just the number.
Before relying on any statement, prove its arithmetic. PreciseBankFlow reads each statement from a digital or scanned PDF, checks that it foots and gives each extracted field a confidence score, so you know which lines to compare to the source before you put weight on them.