SAS No. 150, External Confirmations, is the AICPA Auditing Standards Board's rewrite of how auditors use external confirmation procedures. The Board approved it in May 2026 and the AICPA published it in July 2026. It is effective for audits of financial statements for periods ending on or after December 15, 2028, and early adoption is permitted.
SAS 150 is not a general overhaul of GAAS. It amends AU-C 505 and related standards, including: AU-C 505, External Confirmations, AU-C 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained, and AU-C 500, Audit Evidence. It also makes conforming changes to other sections; read the standard's amendments for the full list. Our guide to the existing procedure is audit confirmations under AU-C 505; this article covers what SAS 150 changes.
The headline change: cash is now in the requirement
AU-C 505 already required confirmation of accounts receivable unless a stated exception applied. SAS 150 adds cash and cash equivalents held by third parties. The AICPA describes it as a new requirement to perform external confirmation procedures for cash and cash equivalents held by third parties, to respond to assessed risks of material misstatement, unless specific exceptions apply. Read the standard's text for the exact exceptions and the documentation the file must hold when the team relies on one.
For most audits a year-end bank confirmation is routine. The practical change is for the low-risk cash balance supported only by a bank statement and reconciliation: expect to need a written basis for not confirming.
Direct access to information at a knowledgeable external source
The standard recognizes that an auditor may obtain relevant and reliable evidence by directly accessing information maintained by a knowledgeable external source, and that this can satisfy certain confirmation requirements. The AICPA says the standard includes related guidance. Decide in advance how the team will control a bank portal session and evaluate reliability. A login that the external source itself issues to the auditor is a different thing from a session the client opens and shares.
Intermediaries
SAS 150 expands the guidance on intermediaries and on the reliability of electronic confirmation responses. In practice, that means evaluating any electronic confirmation platform before relying on it: how requests and responses are protected from interception and alteration, how users are authenticated, and whether the entity can override the platform's controls through a financial, ownership or contractual relationship. A SOC report on the platform may help with that evaluation, but the report has to cover those risks.
Evaluating a platform once at the firm level, documenting the evaluation, and referencing it from each engagement fits the resources component of the firm's system under SQMS No. 1. See network requirements and service providers under SQMS 1.
Negative confirmations
Negative confirmations provide less persuasive evidence than positive ones. SAS 150 sets new conditions that must be met before negative confirmation requests are used to address an assessed risk of material misstatement. Read the conditions in the standard and compare them with how your firm uses negative requests today. The traditional profile for negatives is a population of many small, homogeneous balances with a low expected exception rate.
What to do before 2028
- Add a cash confirmation line to the planning checklist, with a documented basis for any decision not to confirm.
- Build an intermediary evaluation memo at the firm level for any confirmation platform in use, and refresh it annually.
- Decide when direct access is acceptable, and document how the team controls the session and evaluates reliability.
- Review negative confirmation use against the new conditions.
- Plan the transition. Audits of periods ending before December 15, 2028 continue under the current AU-C 505 unless the firm adopts SAS 150 early. A calendar-year firm's first audit under SAS 150 is the December 31, 2028 year-end.
Frequently asked questions
Does SAS 150 change anything for accounts receivable?
The requirement to confirm receivables unless an exception applies remains. SAS 150 adds cash, new guidance on direct access and intermediaries, and new conditions for negative confirmations.
Is a bank portal screenshot acceptable?
A screenshot the client supplies is client-provided information, not a confirmation. Direct access to information maintained by a knowledgeable external source may satisfy the requirement when the evidence is relevant and reliable, so the access has to come from the external source and not from management.
Can SAS 150 be adopted early?
Yes. Early adoption is permitted.
Sources
- AICPA, Statement on Auditing Standards No. 150, External Confirmations (July 2026), including amendments to AU-C 330, 505 and 500 and the effective date paragraphs
- AICPA, "AICPA updates standards involving audit confirmations" (news article): https://www.aicpa-cima.com/news/article/aicpa-updates-standards-involving-audit-confirmations
- Journal of Accountancy, "AICPA updates audit standards related to external confirmations" (July 2026): https://www.journalofaccountancy.com/news/2026/jul/aicpa-updates-audit-standards-related-to-external-confirmations.html
CORAA prepares audit files for US CPA firms from client books; the firm reviews and signs. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error