SAS 150: What the new audit confirmation standard means for CPA firms

SAS 150 modernizes audit confirmations, expands digital evidence options, and prepares firms for a more efficient audit future

Consider the confirmation that went out in February and still hasn't come back in April, despite two calls, two departments, and the news that the client's contact retired last spring. Eventually, the team documents its attempts and moves on to alternative procedures. There are eight other engagements in the queue, and busy season doesn't wait for the mail.

Every firm with an audit practice knows a version of that letter, which is why this summer's news from the American Institute of CPAs (AICPA) deserves more attention than it’s received. In July 2026, weeks after its Auditing Standards Board approved it in May, the AICPA published SAS No. 150, External Confirmations.

Most of the coverage so far has centered on effective dates and amended sections. The more consequential story lies beneath the surface: why the profession continues to rely on this procedure, why executing it has become so inefficient, and what ultimately replaces the envelope.

Why auditors keep sending that letter

The profession relies on confirmations for a reason that hasn't changed in a century. Evidence obtained directly from an independent third party never passes through the client's hands, so no one at the client can shape it. For the balances most susceptible to manipulation, cash and receivables in particular, that independence is precisely the value.

The risk is well documented, too. The Association of Certified Fraud Examiners' Occupational Fraud 2026: A Report to the Nations estimates that organizations lose about 5% of revenue to fraud, and the median scheme runs a year before detection. Financial statement fraud is the least common category but the most costly, with a median loss of $1 million.

None of that is being relaxed. SAS 150, if anything, requires more independent evidence, not less. What the new standard addresses instead is everything surrounding the letter, the printing, mailing, waiting, and follow-up calls, which is where its significance lies.

What SAS 150 actually changes

The full standard is on the AICPA's site for those who want paragraph references. In brief, it makes four changes:

• Cash and cash equivalents held by third parties generally must be confirmed, with limited exceptions.
• Directly accessing records maintained by a knowledgeable external source can satisfy confirmation objectives.
• Intermediaries, which most firms already use, finally receive substantive guidance
• Negative confirmation requests face tighter conditions than before.

Those 4 changes fit together. Cash held by banks and custodians now generally requires confirmation. Yet, the standard also recognizes that the best evidence may come directly from the third party’s records rather than a signed response passed back to the auditor. It then sets out the rules for the intermediary platforms used to obtain that evidence, while limiting the weaker practice of treating a lack of response as support.

SAS 150, therefore, changes both what auditors must confirm and how they can confirm it. Firms have time to work through both sides. The requirements apply to audits of periods ending on or after Dec. 15, 2028, with early adoption permitted. That gives firms room to test the new approach before it becomes mandatory.

Everything else moved first

Why now? Partly because public company auditing has already made this transition. The Public Company Accounting Oversight Board's new confirmation standard, AS 2310, took effect for fiscal years ending on or after June 15, 2025. The guidance it replaced was dated to 1991, several technological generations ago.

The stronger push came from clients, whose treasurers run everything through banking portals and whose tolerance for printing and mailing an auditor's letter narrows every year. Firms that adopted automated bank confirmations consistently report faster responses, fewer follow-ups, and less staff time spent tracking unanswered requests.

Workflow first:  Audit technology reduces engagement friction

What’s more, the profession is further along than the mail-and-wait routine suggests. Wolters Kluwer's 2025 Future Ready Accountant report, covering 2,700-plus professionals in 14 countries, found that 72% use AI at least weekly and 77% plan to increase that investment. Against that backdrop, a fully manual confirmation process is becoming the outlier.

Where the evidence goes next

What replaces the envelope is not exotic technology. The request travels over a secure network because banks prefer a controlled channel to a mailbox. The response returns from the bank's own systems as structured data that the engagement team can test directly, rather than a PDF to be rekeyed into workpapers.

The AICPA is describing the same destination. Announcing the update, Chief Auditor Jennifer Burns called confirmations "a critical source of reliable audit evidence" in an increasingly digital, intermediary-driven environment. In practical terms, the confirmation is becoming a data feed.

None of this transition needs to happen at once, and a phased approach carries less risk. Few firms can absorb a wholesale process change in the middle of busy season. There is solid guidance on standing up a digital audit workflow one piece at a time, and adoption in this profession has always moved client by client, partner by partner.

Digital audit transformation:  See how integrated workflows support data-driven auditing

What to do with the runway

Which brings the discussion back to that February letter, and to the two and a half years between now and the effective date. The runway benefits only firms that use it; waiting until fall 2028 turns an advantage into a scramble.

The most effective use of that time is methodical. Select a handful of engagements next season and run the confirmation process differently on those, and only those. Evaluate which banks support digital channels, and gather feedback from staff. One low-stakes trial cycle yields more practical insight than any training session, which is precisely what the early adoption window is for.

Modernize audit workflows:  Learn how AI helps teams spend less time chasing documents

The stakes are arguably higher for smaller practices than for large firms. When an audit is a dozen engagements inside a tax-focused practice, every hour spent pursuing an unanswered confirmation comes out of the same three or four professionals who also carry the tax workload.

Somewhere down the line, a version of that February confirmation goes out in the morning, with the response arriving the same afternoon. SAS 150 won't carry the profession there on its own, but it makes the direction official. Firms that begin now will simply arrive first.