Controls are good you need less evidence go for negative confirmation request
Controls are weak you need more evidence go for positive confirmation request
basics of SA 505