An unanswered bank confirmation can delay an audit. But the bigger question is whether the evidence ultimately obtained is reliable enough to support the auditor’s conclusions.
SAS 150, External Confirmations, addresses both the requirements for obtaining confirmation evidence and how auditors evaluate that evidence in an increasingly digital, intermediary-driven environment. Its most significant change is a requirement to perform external confirmation procedures for cash and cash equivalents held by third parties in response to assessed risks of material misstatement, unless specified exceptions apply.
The Auditing Standards Board of the AICPA approved SAS 150 External Confirmations in May 2026. The standard was released in July 2026 and significantly revises the external confirmation requirements in AU-C section 505, while also amending AU-C sections 330 and 500. The changes reflect the increasingly digital and intermediary-driven environment in which audit confirmations are performed today.
The changes reflect how auditors obtain and evaluate third-party evidence today, including through electronic channels, confirmation intermediaries, and direct access to information maintained by knowledgeable external sources.
SAS 150 applies to audits of financial statements for periods ending on or after December 15, 2028, with early adoption permitted. For CPA firms, the time before the effective date is an opportunity to review cash confirmation procedures, evaluate digital evidence workflows, and prepare audit methodology and training for the revised requirements.
What actually changed, and why it matters
SAS 150 External Confirmations introduces several important changes to how auditors approach external confirmations. Together, these changes address both the circumstances in which confirmation procedures are required and how auditors obtain and evaluate the resulting evidence.
1. Cash confirmation becomes a more explicit requirement
First and foremost is the SAS 150 cash confirmation requirement. Under the revised standard, auditors must perform external confirmation procedures for cash and cash equivalents held by third parties to respond to assessed risks of material misstatement, unless specified conditions for an exception are met.
This is a particularly important change for audit firms because it makes external confirmation procedures for third-party cash balances an explicit requirement, subject to the standard’s exceptions. Auditors will need to evaluate the applicable requirements and document their conclusions rather than assume that existing cash audit procedures are sufficient.
The change may require firms to revisit audit programs, workpapers, and procedures around cash confirmations.
As part of their preparation, firms should identify engagements involving cash and cash equivalents held by third parties, assess how current procedures align with SAS 150, and determine how applicable exceptions will be evaluated and documented.
2. Greater focus on confirmation intermediaries
Second, SAS 150 expands the requirements and application guidance relating to intermediaries involved in transmitting confirmation requests or responses.
Confirmation platforms, portals, and third-party processors are increasingly involved in the confirmation process. SAS 150 recognizes this environment and provides auditors with requirements and guidance for evaluating factors that affect the reliability of audit evidence obtained through an intermediary.
Electronic confirmations are not prohibited. Instead, auditors need to consider the circumstances surrounding the transmission of a confirmation request or response, as well as factors affecting the reliability of the resulting evidence.
The practical implication is that an electronic confirmation should not be treated as reliable merely because it arrives through a digital platform. Auditors must evaluate the relevant circumstances and determine whether the evidence obtained is sufficiently reliable for the purpose of the audit.
Firms should therefore review how their existing workflows establish the origin of confirmation evidence, maintain control over the confirmation process, and preserve documentation supporting the auditor’s evaluation. The procedures required will depend on the circumstances and the applicable requirements of the standard.
3. Direct access to information maintained by external sources
Third, SAS 150 recognizes direct access to information maintained by a knowledgeable external source as a means of satisfying requirements related to external confirmation procedures, subject to the applicable requirements of the standard.
This is particularly relevant in an environment where financial information can be accessed electronically rather than obtained through a traditional confirmation request sent by mail or email. It provides a framework for considering data-access arrangements as part of the process of obtaining audit evidence.
Direct access can change how auditors obtain evidence, but it does not eliminate the need to evaluate that evidence. Auditors must still consider the source’s knowledge, the information’s relevance and reliability, and whether the procedures performed address the applicable audit objectives.
For firms evaluating digital confirmation workflows, the important question is not simply whether information can be accessed online. It is whether the access arrangement and resulting evidence satisfy the relevant requirements of SAS 150 and support the auditor’s conclusions.
4. Additional considerations for negative confirmations
Fourth, SAS 150 establishes criteria that must be met when auditors use negative confirmation requests to address assessed risks of material misstatement.
Negative confirmations have traditionally provided less persuasive audit evidence than positive confirmations. The revised guidance reinforces the conditions under which negative confirmations may appropriately be used and the need to consider whether they are sufficient to address the assessed risks.
A lack of response to a negative confirmation does not, by itself, establish that the information being tested is correct. Auditors should evaluate whether the conditions for using negative confirmations are satisfied and whether the resulting evidence is appropriate for the assessed risks.
According to Jen Burns, AICPA’s chief auditor, the updated standard responds to changes in the confirmation environment, including the growing role of intermediaries and technology in the transmission and receipt of confirmations.
For the authoritative requirements and their full context, auditors should consult the AICPA’s SAS No. 150 announcement and the full text of SAS No. 150.
SAS 150 vs ISA 505: a global comparison
The changes are particularly relevant for firms operating across U.S. GAAS and international auditing environments.
International audits may be performed in accordance with ISA 505, External Confirmations, issued by the IAASB. The current standard was revised in 2008 and became effective for periods beginning on or after December 15, 2009. It establishes requirements and guidance relating to the use of external confirmations as audit evidence.
However, ISA 505 does not contain the same specific cash-confirmation requirement introduced by SAS 150. Under the current international framework, the use of external confirmations is considered as part of the auditor’s broader risk assessment and response to assessed risks, in accordance with standards such as ISA 315 and ISA 330.
The main differences between SAS 150 and the current version of ISA 505 are summarised below.
| Area | SAS 150 | Current ISA 505 |
| Cash confirmation | Requires external confirmation procedures for cash and cash equivalents held by third parties in response to assessed risks of material misstatement, subject to specified exceptions | Does not contain an equivalent cash-specific requirement |
| Confirmation intermediaries | Introduces updated requirements and application guidance addressing intermediaries | Existing requirements apply while revisions to the standard are being developed |
| Direct access | Recognizes qualifying direct access to information maintained by a knowledgeable external source as a means of satisfying requirements relating to external confirmation procedures | Must be assessed under the applicable current international auditing framework |
| Negative confirmations | Establishes criteria that must be met when using negative confirmation requests | Governed by the requirements of the current ISA 505 |
| Effective date | Applies to audits of financial statements for periods ending on or after December 15, 2028; early adoption is permitted | Current ISA 505 applies to audits of financial statements for periods beginning on or after December 15, 2009 |
The effective-date conventions differ: SAS 150 refers to periods ending on or after a specified date, while ISA 505 refers to periods beginning on or after its effective date. These dates should not be treated as directly equivalent.
The international landscape is also evolving. As of October 2026, the IAASB has discussed initial full drafts of proposed revisions to ISA 505. The board plans to review exposure drafts in December 2026, subject to approval, before a public consultation expected to open in February 2027. The current ISA 505 requirements remain the relevant reference until revised requirements are finalized and become effective. Firms can monitor progress through the IAASB’s official ISA 505 project page.
For international and network firms, this makes it important to identify where confirmation procedures differ across engagements and jurisdictions and to consider those differences when updating audit methodology and training.
Firms should also distinguish SAS 150 from the PCAOB’s AS 2310, The Auditor’s Use of Confirmation. AS 2310 became effective for relevant audits of financial statements for fiscal years ending on or after June 15, 2025. It provides useful context for the broader evolution of confirmation practices, but it is a separate standard with its own scope and requirements. See the PCAOB’s official AS 2310 guidance.
What CPAs should do between now and 2028
The 2028 effective date gives firms time to prepare. Rather than waiting until implementation becomes urgent, firms can use this period to test revised workflows, identify gaps, and incorporate the changes into their existing audit methodology. Four areas are worth reviewing now.
1. Review current cash confirmation procedures
Identify engagements where cash or cash equivalents held by third parties have historically not been externally confirmed. Review those procedures against the revised requirements and determine where audit programs, templates, or documentation may need to change.
The review should establish which engagements are affected, how the relevant requirements will be addressed, and how any applicable exceptions will be assessed and documented. This gives engagement teams a consistent starting point for applying the standard.
2. Review confirmation workflows and intermediaries
Inventory the platforms, portals, intermediaries, and electronic processes currently used for confirmations. Firms should consider how the reliability of confirmation evidence is established and documented when an intermediary is involved.
Firms may also want to assess whether their existing confirmation workflow provides the control, documentation, reliability, and audit trail needed to consistently apply the new requirements at scale.
A practical next step is to select a small number of engagements for a pilot review. Teams can evaluate how requests are initiated, how responses or source information are obtained, what evidence is retained, and where additional procedures or documentation may be needed.
3. Evaluate direct-access options
Consider situations where directly accessing information maintained by knowledgeable external sources could provide an efficient means of obtaining audit evidence under the revised framework. This may be particularly relevant for firms looking to modernize confirmation processes without relying exclusively on traditional request-and-response workflows.
Evaluate direct-access arrangements against the standard’s requirements, including the reliability and relevance of the information obtained. A digital workflow should be adopted because it supports the audit objective and the required evidence—not simply because it reduces manual work.
4. Prepare methodology, training and documentation
Update audit methodology, workpapers, confirmation templates and team training before the effective date. For international and network firms, it may also be useful to create a practical guide comparing SAS 150 with the current requirements of ISA 505.
Firms can begin by documenting the changes to their existing procedures, assigning responsibility for updating templates and guidance, and training engagement teams on the revised requirements. Pilot results can then inform broader implementation before the effective date.
A standard built for how audits run today
SAS 150 External Confirmations is not a completely new approach to external confirmations. Rather, it updates the standards to reflect how confirmations are increasingly conducted in a technology-enabled, intermediary-driven environment.
The cash confirmation requirement is likely to receive significant attention because it establishes a more explicit requirement for external confirmation procedures relating to cash and cash equivalents held by third parties. But the changes involving intermediaries and direct access to information are also important because they address how auditors obtain and evaluate confirmation evidence in modern workflows.
For firms preparing for the 2028 effective date, the focus should not be limited to changing a single confirmation step. It should be on whether the firm’s overall confirmation workflow can consistently support reliable evidence, appropriate controls, and clear audit documentation.
This is also an opportunity to identify operational bottlenecks, evaluate the reliability of existing evidence channels, and develop a repeatable approach to confirmation procedures across engagements. The objective is not simply to digitize an existing process, but to ensure that the process continues to support the auditor’s responsibilities.
What SAS 150 means for confirmation technology
SAS 150 does not prescribe a particular confirmation platform. It does, however, place greater emphasis on external confirmation procedures for cash, the reliability of evidence obtained from intermediaries, and direct access to information held by knowledgeable external sources.
Those changes make the architecture behind a confirmation workflow increasingly important.
When evaluating audit confirmation technology, firms should consider how the workflow obtains information from external sources, supports the auditor’s assessment of evidence reliability, preserves relevant records, and provides documentation that can be reviewed during the audit. Technology should support the auditor’s procedures and judgments rather than replace them.
AuditConfirm is designed around direct-source evidence and auditor-controlled workflows. The platform enables firms to obtain financial information directly from source institutions with client consent, preserve the original evidence and supporting audit trail, and manage confirmations across a global network of financial institutions.
For firms operating across jurisdictions, coverage also matters. AuditConfirm provides connectivity to more than 44,000 banks across 195+ countries, allowing firms to use a consistent confirmation and direct-source evidence workflow across a broad portion of their client base.
These capabilities may be relevant to firms reviewing their confirmation processes ahead of the 2028 effective date. Their suitability for a particular engagement will depend on the workflow used, the source and nature of the information obtained, and the applicable requirements of the standard.
For firms reviewing their confirmation methodology ahead of the 2028 effective date, AuditConfirm offers a way to modernize the process without requiring them to build the underlying connectivity and evidence infrastructure themselves.
Disclaimer: AuditConfirm does not replace the auditor’s responsibility to evaluate evidence or determine whether the requirements of SAS 150 have been met. Firms should assess any confirmation solution against their own methodology, engagement needs, and professional obligations.
FAQs
What is SAS 150?
SAS 150 is an AICPA auditing standard that significantly revises the external confirmation requirements in AU-C section 505 and makes related amendments to other auditing standards. It addresses external confirmations in today’s increasingly digital, intermediary-driven audit environment.
Does SAS 150 require auditors to confirm cash?
SAS 150 requires auditors to perform external confirmation procedures for cash and cash equivalents held by third parties when responding to assessed risks of material misstatement, unless specified conditions for an exception are met.
When does SAS 150 take effect?
SAS 150 applies to audits of financial statements for periods ending on or after December 15, 2028. Early adoption is permitted.
What does SAS 150 say about confirmation intermediaries?
SAS 150 expands the requirements and application guidance auditors should consider when an intermediary is involved in transmitting confirmation requests or responses, including factors that affect the reliability of the resulting audit evidence.
Does SAS 150 allow auditors to directly access information from external sources?
Yes. SAS 150 recognizes direct access to information maintained by a knowledgeable external source as a means of satisfying requirements related to external confirmation procedures, subject to the applicable requirements of the standard.
What is the main difference between SAS 150 vs ISA 505?
SAS 150 introduces specific requirements relating to external confirmation procedures for cash and cash equivalents held by third parties, subject to specified exceptions. The current version of ISA 505 does not include a cash-specific requirement; instead, it addresses external confirmations within the broader audit risk assessment framework.
Does SAS 150 apply outside the United States?
SAS 150 applies to audits performed under applicable AICPA auditing standards; it does not replace ISA 505 for engagements conducted under International Standards on Auditing. Firms operating across U.S. GAAS and ISA environments should consider the requirements applicable to each engagement and monitor ongoing developments to ISA 505.