Auditors used to think that "Controlling" the confirmation process meant putting the confirmations in the blue mailboxes ourselves and that the responses must come back to our offices and not the client's. In truth, we lost control of the confirmation process when we relied on and took the address of where to send the confirmations from either (1) the client or material in the client's possession, or (2) last year's work papers where at some point someone simply asked the client for where to send the confirmation or took that information off of client provided material.
I would submit that the audit standards are actually well written and what is needed is not more standards, but instead – regardless of the process used: mail, fax, electronic confirmations - auditors need to actually validate where they are sending the confirmations and authenticate the authorization and identity of the person who responded to the confirmation. Otherwise frauds involving fake confirmations like Parmalat, Satyam, Ahold, Take-Two Interactive, Just-for-Feet, CF Foods, ZZZZ Best and others will continue to happen.

Brian Fox, CPA
http://www.confirmation.com