Yes – replies to any “external confirmation request” by the auditor must be received directly by the auditor. The whole point of external confirmation is that it is obtained independently for comparison/reconciliation with documentation held by the entity (e.g. monthly bank statements sent to the entity).