The auditor should retain custody of the confirmation letters until they are mailed.
The confirmation letters, together with self-addressed stamped envelopes, should be addressed to the auditor, rather than the client organization.
The confirmation request should be mailed by the auditor. If client mailroom personnel participate in the process, they should be adequately supervised.