You are correct. An auditor would send out A/R confirmation(s) to a statistical sampling of customers. If customers were reporting different numbers which Steve could not reconcile. Then, the auditor would expand the sample because the level of inherent risk of fraud rose.
An auditor will quickly find out which is correct.