SAS 150 External Confirmations introduces one of the most significant changes to U.S. external confirmation requirements in years. Most notably, auditors will generally be required to perform external confirmation procedures for cash and cash equivalents held by third parties, subject to specified exceptions. The standard also addresses intermediaries, direct access to information maintained by knowledgeable external sources, and negative confirmation requests.
The Auditing Standards Board of the AICPA approved SAS 150 External Confirmations in May 2026. The standard was released in July 2026 and significantly revises the external confirmation requirements in AU-C section 505, while also amending AU-C sections 330 and 500. The changes reflect the increasingly digital and intermediary-driven environment in which audit confirmations are performed today.
Auditors will need to comply with the standard for audits of financial statements for periods ending on or after December 15, 2028, with early adoption permitted. While the effective date is still ahead, firms have an opportunity to review their audit methodology, workpapers, confirmation workflows, and team training well before the new requirements become effective.
What actually changed, and why it matters
SAS 150 External Confirmations introduces several important changes to how auditors approach external confirmations. Four areas are particularly relevant for audit firms.
1. Cash confirmation becomes a more explicit requirement
First and foremost is the SAS 150 cash confirmation requirement. Under the revised standard, auditors must perform external confirmation procedures for cash and cash equivalents held by third parties to respond to assessed risks of material misstatement, unless specified conditions for an exception are met.
This makes external confirmation a more clearly defined part of the audit approach for cash and cash equivalents, while preserving specific circumstances in which an auditor may determine that confirmation is not required.
The change is significant for audit firms because it may require them to revisit existing audit programs, documentation, and procedures around cash confirmations.
2. Greater focus on confirmation intermediaries
Second, SAS 150 expands the requirements and application guidance relating to intermediaries involved in transmitting confirmation requests or responses.
Confirmation platforms, portals, and third-party processors are increasingly involved in the confirmation process. SAS 150 recognizes this environment and provides auditors with requirements and guidance for evaluating factors that affect the reliability of audit evidence obtained through an intermediary.
Electronic confirmations are not prohibited. Instead, auditors need to consider the circumstances surrounding the transmission of a confirmation request or response, as well as factors affecting the reliability of the resulting evidence.
3. Direct access to information maintained by external sources
Third, SAS 150 recognizes direct access to information maintained by a knowledgeable external source as a means of satisfying requirements related to external confirmation procedures, subject to the applicable requirements of the standard.
This is particularly relevant in an environment where financial information can be accessed electronically rather than obtained through a traditional confirmation request sent by mail or email. It provides a framework for considering data-access arrangements as part of the process of obtaining audit evidence.
4. Additional considerations for negative confirmations
Fourth, SAS 150 establishes criteria that must be met when auditors use negative confirmation requests to address assessed risks of material misstatement.
Negative confirmations have traditionally provided less persuasive audit evidence than positive confirmations. The revised guidance reinforces the conditions under which negative confirmations may appropriately be used and the need to consider whether they are sufficient to address the assessed risks.
According to Jen Burns, AICPA’s chief auditor, the updated standard responds to changes in the confirmation environment, including the growing role of intermediaries and technology in the transmission and receipt of confirmations.
SAS 150 vs ISA 505: a global comparison
The changes are particularly relevant for firms operating across U.S. GAAS and international auditing environments.
International audits may be performed in accordance with ISA 505, External Confirmations, issued by the IAASB. The current standard was revised in 2008 and became effective for periods beginning on or after December 15, 2009. It establishes requirements and guidance relating to the use of external confirmations as audit evidence.
However, ISA 505 does not contain the same specific cash-confirmation requirement introduced by SAS 150. Under the current international framework, the use of external confirmations is considered as part of the auditor’s broader risk assessment and response to assessed risks, in accordance with standards such as ISA 315 and ISA 330.
This creates an important distinction between SAS 150 and the current version of ISA 505. SAS 150 establishes specific requirements relating to external confirmation procedures for cash and cash equivalents held by third parties, subject to specified exceptions, while ISA 505 does not contain an equivalent cash-specific requirement. SAS 150 also provides updated requirements and guidance regarding intermediaries and direct access to information from knowledgeable external sources.
The international landscape is also evolving. As of 2026, the IAASB is undertaking a project to revise ISA 505, with the objective of modernizing external confirmation requirements to better reflect technology and today’s audit environment. Firms operating across U.S. GAAS and ISA environments should therefore monitor developments in both standards rather than assuming that the current differences between them will remain permanent.
For international and network firms, this makes it important to identify where confirmation procedures differ across engagements and jurisdictions and to consider those differences when updating audit methodology and training.
What CPAs should do between now and 2028
The 2028 effective date gives firms time to prepare. Four areas are worth reviewing now.
1. Review current cash confirmation procedures
Identify engagements where cash or cash equivalents held by third parties have historically not been externally confirmed. Review those procedures against the revised requirements and determine where audit programs, templates, or documentation may need to change.
2. Review confirmation workflows and intermediaries
Inventory the platforms, portals, intermediaries, and electronic processes currently used for confirmations. Firms should consider how the reliability of confirmation evidence is established and documented when an intermediary is involved.
Firms may also want to assess whether their existing confirmation workflow provides the control, documentation, reliability, and audit trail needed to consistently apply the new requirements at scale.
3. Evaluate direct-access options
Consider situations where directly accessing information maintained by knowledgeable external sources could provide an efficient means of obtaining audit evidence under the revised framework. This may be particularly relevant for firms looking to modernize confirmation processes without relying exclusively on traditional request-and-response workflows.
4. Prepare methodology, training and documentation
Update audit methodology, workpapers, confirmation templates and team training before the effective date. For international and network firms, it may also be useful to create a practical guide comparing SAS 150 with the current requirements of ISA 505.
A standard built for how audits run today
SAS 150 External Confirmations is not a completely new approach to external confirmations. Rather, it updates the standards to reflect how confirmations are increasingly conducted in a technology-enabled, intermediary-driven environment.
The cash confirmation requirement is likely to receive significant attention because it establishes a more explicit requirement for external confirmation procedures relating to cash and cash equivalents held by third parties. But the changes involving intermediaries and direct access to information are also important because they address how auditors obtain and evaluate confirmation evidence in modern workflows.
For firms preparing for the 2028 effective date, the focus should not be limited to changing a single confirmation step. It should be on whether the firm’s overall confirmation workflow can consistently support reliable evidence, appropriate controls, and clear audit documentation.
What SAS 150 means for confirmation technology
SAS 150 does not prescribe a particular confirmation platform. It does, however, place greater emphasis on external confirmation procedures for cash, the reliability of evidence obtained from intermediaries, and direct access to information held by knowledgeable external sources.
Those changes make the architecture behind a confirmation workflow increasingly important.
AuditConfirm is designed around direct-source evidence and auditor-controlled workflows. The platform enables firms to obtain financial information directly from source institutions with client consent, preserve the original evidence and supporting audit trail, and manage confirmations across a global network of financial institutions.
For firms operating across jurisdictions, coverage also matters. AuditConfirm provides connectivity to more than 44,000 banks across 195+ countries, allowing firms to use a consistent confirmation and direct-source evidence workflow across a broad portion of their client base.
For firms reviewing their confirmation methodology ahead of the 2028 effective date, AuditConfirm offers a way to modernize the process without requiring them to build the underlying connectivity and evidence infrastructure themselves.
FAQs
What is SAS 150?
SAS 150 is an AICPA auditing standard that significantly revises the external confirmation requirements in AU-C section 505 and makes related amendments to other auditing standards. It addresses external confirmations in today’s increasingly digital, intermediary-driven audit environment.
Does SAS 150 require auditors to confirm cash?
SAS 150 requires auditors to perform external confirmation procedures for cash and cash equivalents held by third parties when responding to assessed risks of material misstatement, unless specified conditions for an exception are met.
When does SAS 150 take effect?
SAS 150 applies to audits of financial statements for periods ending on or after December 15, 2028. Early adoption is permitted.
What does SAS 150 say about confirmation intermediaries?
SAS 150 expands the requirements and application guidance auditors should consider when an intermediary is involved in transmitting confirmation requests or responses, including factors that affect the reliability of the resulting audit evidence.
Does SAS 150 allow auditors to directly access information from external sources?
Yes. SAS 150 recognizes direct access to information maintained by a knowledgeable external source as a means of satisfying requirements related to external confirmation procedures, subject to the applicable requirements of the standard.
What is the main difference between SAS 150 vs ISA 505?
SAS 150 introduces specific requirements relating to external confirmation procedures for cash and cash equivalents held by third parties, subject to specified exceptions. The current version of ISA 505 does not include a cash-specific requirement; instead, it addresses external confirmations within the broader audit risk assessment framework.
Does SAS 150 apply outside the United States?
SAS 150 applies to audits performed under applicable AICPA auditing standards; it does not replace ISA 505 for engagements conducted under International Standards on Auditing. Firms operating across U.S. GAAS and ISA environments should consider the requirements applicable to each engagement and monitor ongoing developments to ISA 505.